ccaafefa8f655f50ed4e9de13407c7def1924f4d43431173bec5375cc04bd5ad

Analysis

max time kernel
134s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
24/07/2024, 02:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6a010776c73883e814a9d9cec133bd6c_JaffaCakes118.exe
Size

135KB
MD5

6a010776c73883e814a9d9cec133bd6c
SHA1

d1f4db14b72852fd0ac685f549528a0a5ecfe2dd
SHA256

ccaafefa8f655f50ed4e9de13407c7def1924f4d43431173bec5375cc04bd5ad
SHA512

fb56d834f80b6db8bc87ecaee8b4e4911a1a557531417c08607347dbd2b5e724f19ba6bb5c6a51f3f8ca9d3a1c54595a72d970c53bd751fcb5372e31eacd93bd
SSDEEP

3072:7tnhDBrzg41xPQG6e/pXeESPVlClzt8UZjx9dFVf:7dPs6xPhn/pXeESNwlLRdF

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
1972	6a010776c73883e814a9d9cec133bd6c_JaffaCakes118.exe
1972	6a010776c73883e814a9d9cec133bd6c_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\windows\SysWOW64\sporder.dll	6a010776c73883e814a9d9cec133bd6c_JaffaCakes118.exe
File created	\??\c:\windows\SysWOW64\rsvp322.dll	6a010776c73883e814a9d9cec133bd6c_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6a010776c73883e814a9d9cec133bd6c_JaffaCakes118.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
1972	6a010776c73883e814a9d9cec133bd6c_JaffaCakes118.exe
660	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	1972	6a010776c73883e814a9d9cec133bd6c_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1972	6a010776c73883e814a9d9cec133bd6c_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\6a010776c73883e814a9d9cec133bd6c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6a010776c73883e814a9d9cec133bd6c_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\rsvp322.dll

Filesize
108KB

MD5
4ffb16595925706018877ee2f02c3ac8

SHA1
8c03c569680c6cb58f7f664f338bb34a025e6712

SHA256
ad3598f4188e6df74b8d24d22db31a2a0080923e59bd81fb9a08eca3da708ee5

SHA512
61723cbfdc0f97b3a7167a0d554972917cd72b29f1c0bd6f2c47dc3287bb54b2d9960606afedd6becceb65ccecddca7a601b9ac832edac2e87eb9ef6f2c81bc1

Download Submit
C:\Windows\SysWOW64\sporder.dll

Filesize
8KB

MD5
a082e5473b2a9a4d846ed7ddf637ac76

SHA1
1703f7969a6e76f8458eda3e8e40fd115c0bfdc3

SHA256
73f7171c2af70ccf8ee4c49626fb456807a6a668f6a967298dcd5ed29773bd2a

SHA512
abc1ea5a46d0784db23ddd9bd984527913c3e40a3896cfa43e9f4f999e4064038b24aed78e27bf2e705c8c55482e801f520987c2a74be6f01edc32df3d235eaa

Download Submit
memory/1972-0-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1972-8-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download