6311f3c9c4697fbc38e4f6022425ebb560883b5b841e2d3427206c8246ab6e05

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
25-07-2024 09:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6ef462bbe8b0c922cc261ba8bd6d5c07_JaffaCakes118.exe
Size

16KB
MD5

6ef462bbe8b0c922cc261ba8bd6d5c07
SHA1

1ad019bd29c172bb3160db8be62ba2f54476da03
SHA256

6311f3c9c4697fbc38e4f6022425ebb560883b5b841e2d3427206c8246ab6e05
SHA512

ea06d3ebf1270228674fc9a85fcfaab3ecf909ee6d7d2f3bd0a0e34642671ca8a670614e48c2d09c657d706fbd23755be6218114d3f55e6787cb73b6f76c7e4a
SSDEEP

384:l4uBMeI4Ep1+9aWM6XpwXsNU7cSB3bUhrtSl:2uYB4D5QDyt0

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2676	6ef462bbe8b0c922cc261ba8bd6d5c07_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6ef462bbe8b0c922cc261ba8bd6d5c07_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2676	6ef462bbe8b0c922cc261ba8bd6d5c07_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\6ef462bbe8b0c922cc261ba8bd6d5c07_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6ef462bbe8b0c922cc261ba8bd6d5c07_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\MICKNEWWOWTRO\MICKNEWWOWTRO.DLL

Filesize
25KB

MD5
376976a57260802ee879c654efd2cc4a

SHA1
b192bb46336a662a04ee20db357971cffb785112

SHA256
1e7920eb0e673ea0f54511e09b3223cc760a767607de93fa95767bb2facc8bca

SHA512
ec458cf267a73c46004343ccba02f59b799262b195b523d095c127c743f5921cd9c61b4359306f560d3e00aa18edce49eabd0b83f63f18bc66d01b40fc0633c9

Download Submit
memory/2676-2-0x00000000001B0000-0x00000000001BC000-memory.dmp

Filesize
48KB

Download
memory/2676-4-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download