1ea1a4fe3c327ce1ee00e03b1095506ee279368cf19674fe2db4bfb17fcbb3b9

Analysis

max time kernel
141s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
24/07/2024, 08:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6ae54d1f5909f69a7b23eab25db41126_JaffaCakes118.exe
Size

181KB
MD5

6ae54d1f5909f69a7b23eab25db41126
SHA1

62bf9182014ead423802112045c73a1ada3b2923
SHA256

1ea1a4fe3c327ce1ee00e03b1095506ee279368cf19674fe2db4bfb17fcbb3b9
SHA512

ce3efaf0e8a09b98605a8632f407cc0ceef05f52ef0cb20238e49c2d0cc6dbfea3e7d71972325269ac352965d0649dabb0fb0d0ee0ca14ec07ff4c91ddcf0d00
SSDEEP

3072:hADRRRRRRRRRPBcPyzNldq/3qQjF/30GYVJUejRxdomKCE77+1FvzobwC7eQpHA3:hADRRRRRRRRRPvoqEpeJUejRxdomjEv/

Score

5^/10

discovery

Malware Config

Signatures

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\cftmon.exe	6ae54d1f5909f69a7b23eab25db41126_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\mshdtxt32.dat	6ae54d1f5909f69a7b23eab25db41126_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\mshdtxt32.dat	6ae54d1f5909f69a7b23eab25db41126_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6ae54d1f5909f69a7b23eab25db41126_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2880	6ae54d1f5909f69a7b23eab25db41126_JaffaCakes118.exe
2880	6ae54d1f5909f69a7b23eab25db41126_JaffaCakes118.exe
2880	6ae54d1f5909f69a7b23eab25db41126_JaffaCakes118.exe
2880	6ae54d1f5909f69a7b23eab25db41126_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2880	6ae54d1f5909f69a7b23eab25db41126_JaffaCakes118.exe
2880	6ae54d1f5909f69a7b23eab25db41126_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\6ae54d1f5909f69a7b23eab25db41126_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6ae54d1f5909f69a7b23eab25db41126_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2880-0-0x0000000000400000-0x000000000046E305-memory.dmp

Filesize
440KB

Download
memory/2880-5-0x0000000000400000-0x000000000046E305-memory.dmp

Filesize
440KB

Download