55047a79e8b5cbcfe63657462d75a69acd032c2c463db72f015de85930e0a260

Analysis

max time kernel
141s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
01-08-2024 21:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

81cdb98fa2cf46e1cfe165508179248e_JaffaCakes118.exe
Size

13.2MB
MD5

81cdb98fa2cf46e1cfe165508179248e
SHA1

f6183b510a4dc9fb5b2bdbffb640da2f04ba29a7
SHA256

55047a79e8b5cbcfe63657462d75a69acd032c2c463db72f015de85930e0a260
SHA512

3f671c0f4a9cf7c708a9c1677e7d7b9f4753b92220578ed4dbce05d0ca56edee07f727d19d361b13fa7d1a8b530fc8c810203831a48323b966bf06062ba4fcc3
SSDEEP

393216:+y+odHuBvuZLKvCLpWrPYX0askIp+0LYNo3Lu6YKE:+SdO8QPYXnsFo0Mm3Lu6YKE

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	81cdb98fa2cf46e1cfe165508179248e_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-113082768-653872390-2867000172-1000\Software\Microsoft\Internet Explorer\IESettingSync	81cdb98fa2cf46e1cfe165508179248e_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-113082768-653872390-2867000172-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	81cdb98fa2cf46e1cfe165508179248e_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-113082768-653872390-2867000172-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	81cdb98fa2cf46e1cfe165508179248e_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-113082768-653872390-2867000172-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	81cdb98fa2cf46e1cfe165508179248e_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1312	81cdb98fa2cf46e1cfe165508179248e_JaffaCakes118.exe
1312	81cdb98fa2cf46e1cfe165508179248e_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\81cdb98fa2cf46e1cfe165508179248e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\81cdb98fa2cf46e1cfe165508179248e_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\InstallTmp\Config.txt

Filesize
2KB

MD5
91b573962e0c8ac67424a87a9a6742ab

SHA1
234a265a2edc9fa4126efa4562ccbb8af31d7b49

SHA256
7bc184ac0628271ae1fed0acda88c77e89e093811869efe12142a637cc5e1868

SHA512
5f5bfaaad8c59ee2d32465d9f83a39ea5b4134fa49fa6d8170d2bd3ee83890553e958bf3ceff2156c84bf2c0cb9e4d4fe367898719ca775487ebd97abd5226e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\InstallTmp\Readme.txt

Filesize
5KB

MD5
660283212989828403126967ca7af80e

SHA1
d2390fbf12c5692f3046a75fa6d10582831e06e3

SHA256
2b883de63e0b3e25a31ee2813a1e868c6733439167ad77ae46284699e286a8e0

SHA512
01d49226a00e4b7abce0843f30dcd3e5815146c3a444fc1f8b3ad462c2749e152084c5a994a6eb6cd4abb1b316680c0a3d78f5fecfc896dec5e9a9af39a90754

Download Submit
memory/1312-0-0x00000000022C0000-0x00000000022C1000-memory.dmp

Filesize
4KB

Download
memory/1312-180-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download
memory/1312-182-0x00000000022C0000-0x00000000022C1000-memory.dmp

Filesize
4KB

Download