8320beeac5d1d41ffa1c3a1a133b3124b6a78e25d4915606f220fbf28708b549

Analysis

max time kernel
143s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
25-07-2024 21:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

713778f9b2c13fbdfc108fbd82aa2a2b_JaffaCakes118.exe
Size

144KB
MD5

713778f9b2c13fbdfc108fbd82aa2a2b
SHA1

b34811ad6b8dea81458316d0f9d42c450e9807bf
SHA256

8320beeac5d1d41ffa1c3a1a133b3124b6a78e25d4915606f220fbf28708b549
SHA512

4e411ef14de5d998a236f5a0fb47ca23b2703b363491ce6f990d15f8710cd9f4cd0fb8dcd9985c253150d874e8bb036fe8c5c2bb16f0a0ad88487d7f1357f9c9
SSDEEP

3072:OD9HkpyWGJZ8ccMyv2zRgWLHgUogNiKNZpTt/O:ONaZMyu9gWT+BiZbO

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	713778f9b2c13fbdfc108fbd82aa2a2b_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Software\Microsoft\Internet Explorer\IESettingSync	713778f9b2c13fbdfc108fbd82aa2a2b_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	713778f9b2c13fbdfc108fbd82aa2a2b_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	713778f9b2c13fbdfc108fbd82aa2a2b_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	713778f9b2c13fbdfc108fbd82aa2a2b_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2312	713778f9b2c13fbdfc108fbd82aa2a2b_JaffaCakes118.exe
2312	713778f9b2c13fbdfc108fbd82aa2a2b_JaffaCakes118.exe
2312	713778f9b2c13fbdfc108fbd82aa2a2b_JaffaCakes118.exe
2312	713778f9b2c13fbdfc108fbd82aa2a2b_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\713778f9b2c13fbdfc108fbd82aa2a2b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\713778f9b2c13fbdfc108fbd82aa2a2b_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\86E3.tmp

Filesize
639B

MD5
f755a0fc61ffa205eff19a9798a478c0

SHA1
489cade0c3e245f3f03c490a7f956522cdee4ecf

SHA256
bc6dc94c832e5824c7e264b96078913e2a03d1b0da6a1c0ea923a8646d6c1284

SHA512
a99b7e4144bb1963351c52d37251350e6ca2de6881b69b07187af2f91019be867530c77d45c1b3de008c33a306e00982d4e341709d6558f1bcec8d0ae5fd68c2

Download Submit
memory/2312-0-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2312-1-0x0000000000530000-0x0000000000532000-memory.dmp

Filesize
8KB

Download
memory/2312-23-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2312-24-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2312-36-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download