a993273690820ca8f42506661043e9deb9665f6d27d1b0164d0d4cf73d374dff

Analysis

max time kernel
136s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
25-07-2024 19:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe
Size

3.4MB
MD5

70d8201221fcbcbb0989f3abc48f86eb
SHA1

dd8b9d75bef2c57b1d70b8c44969fbd645ab4066
SHA256

a993273690820ca8f42506661043e9deb9665f6d27d1b0164d0d4cf73d374dff
SHA512

ef628fe0901f18d499ebef396f7534b480382adeecf2723d7cc26855370bf6f1dd78d6a08447daab53bf64710f8eafc9b889117097328bd87ced28d2b0e32c64
SSDEEP

49152:0h24ZF6AKGzdEgSLLMC5wsyt2eaQZcyf1apPiUy:VIYdGz6ZkC5J/Vyf1aNid

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 11 IoCs

pid	Process
3224	70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe
3224	70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe
3224	70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe
3224	70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe
3224	70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe
3224	70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe
3224	70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe
3224	70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe
3224	70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe
3224	70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe
3224	70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3224	70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe
3224	70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe
3224	70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe
3224	70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe
3224	70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe
3224	70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe
3224	70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe
3224	70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe
3224	70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe
3224	70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe
3224	70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe
3224	70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe
3224	70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe
3224	70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe
3224	70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe
3224	70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe
3224	70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe
3224	70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe
3224	70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe
3224	70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe
3224	70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe
3224	70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe
3224	70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe
3224	70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe
3224	70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe
3224	70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe
3224	70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe
3224	70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe
3224	70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe
3224	70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe
3224	70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe
3224	70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe
3224	70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe
3224	70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe
3224	70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe
3224	70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe
3224	70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe
3224	70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe
3224	70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe
3224	70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe
3224	70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe
3224	70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe
3224	70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe
3224	70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe
3224	70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe
3224	70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe
3224	70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe
3224	70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe
3224	70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe
3224	70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe
3224	70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe
3224	70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe
3224	70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe
3224	70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe
3224	70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe
3224	70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe
3224	70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe
3224	70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe
3224	70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe
3224	70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe
3224	70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe
3224	70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe
3224	70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe
3224	70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\70d8201221fcbcbb0989f3abc48f86eb_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\E_N4\BmpOperate.fnr

Filesize
96KB

MD5
65fce30de3dd331511eadc4a3012dd1e

SHA1
cd1a53d50874624c141fdc2550cacfec98676d0a

SHA256
3babf33e5aef7f0e125d86f68f906cd0e18f0b888f36a6768333965edc38e194

SHA512
056bd1733a24de28c12918044f305ca093d4db4590d6617e8818518633c50048bbe4a0c05a117d0de1bf0dec827b3c5171f31d6b49422267e0bca2b105f431a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\E_N4\HtmlView.fne

Filesize
212KB

MD5
4c9e8f81bf741a61915d0d4fc49d595e

SHA1
d033008b3a0e5d3fc8876e0423ee5509ecb3897c

SHA256
951d725f4a12cd4ff713ca147fa3be08a02367db6731283c3f1ba30445990129

SHA512
cf2c6f8f471c8a5aad563bc257035515860689b73ce343599c7713de8bc8338a031a722f366e005bc1907d6fc97b68b8b415e8ff05b7324fb1040c5dc02315d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\E_N4\eGrid.fne

Filesize
424KB

MD5
90094079971d843d55f19f9d7315a42a

SHA1
18bebc755fc07a59c6680dd2bf844d417dbf6daf

SHA256
307af591d1cea90a3535ad3584bbd49ca5fb0fbc728dd4ffb88c392470c259d5

SHA512
4d17f7bdd2311b8ff500c981d787c473c87b884429e14690a430d47702063f861da2df842e64f630e899d95312e662820ddb4742bf5a2f7be7db3d0798eebc94

Download Submit
C:\Users\Admin\AppData\Local\Temp\E_N4\iext.fnr

Filesize
216KB

MD5
cba933625bfa502fc4a1d9f34e1e4473

SHA1
5319194388c0e53321f99f1541b97af191999a09

SHA256
25549c7781b3f1b92e73b0ea721d177207cce914a66f3229a71291f2eb160013

SHA512
f5fb4b97c4f68a20e0847e6528740ce659c4501726f3b2dff1ac83e88a3b7198099da03edb0f069cd4af7ed568a2373597b235cd239895addfa5226d3a444142

Download Submit
C:\Users\Admin\AppData\Local\Temp\E_N4\iext3.fne

Filesize
380KB

MD5
07f0db2727c8288cd2cf7c4cf352708d

SHA1
caf2d1b631c785c1f6f01189cf841fc2661666ed

SHA256
3c18183857979a2b5664d3f852f74e3f31f0626720654914453e964938e18f5e

SHA512
b81029a2968663a180feca2e3e47f4736f87a7cc73e6a9153aa227b91d963e077f44c5a289b9f64d6b481b7bd5ccb4bcb762048a4f29810c1f4fd4e6106cb0d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\E_N4\krnln.fnr

Filesize
1.1MB

MD5
638e737b2293cf7b1f14c0b4fb1f3289

SHA1
f8e2223348433b992a8c42c4a7a9fb4b5c1158bc

SHA256
baad4798c3ab24dec8f0ac3cde48e2fee2e2dffa60d2b2497cd295cd6319fd5b

SHA512
4d714a0980238c49af10376ff26ec9e6415e7057925b32ec1c24780c3671047ac5b5670e46c1c6cf9f160519be8f37e1e57f05c30c6c4bda3b275b143aa0bf12

Download Submit
memory/3224-21-0x0000000002310000-0x0000000002329000-memory.dmp

Filesize
100KB

Download
memory/3224-34-0x0000000003A90000-0x0000000003AD4000-memory.dmp

Filesize
272KB

Download
memory/3224-41-0x0000000003C80000-0x0000000003CEF000-memory.dmp

Filesize
444KB

Download
memory/3224-27-0x0000000002760000-0x0000000002798000-memory.dmp

Filesize
224KB

Download
memory/3224-0-0x0000000000400000-0x00000000005AD000-memory.dmp

Filesize
1.7MB

Download
memory/3224-48-0x0000000003D30000-0x0000000003DA9000-memory.dmp

Filesize
484KB

Download
memory/3224-60-0x0000000000400000-0x00000000005AD000-memory.dmp

Filesize
1.7MB

Download