d98cc9cf69b669bc7b7b561730ac179df4e099ddab3c35ec1dadd242b1245825

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10/08/2024, 04:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

84bf97192c1b7c8aa7b532553a671d3f_JaffaCakes118.exe
Size

597KB
MD5

84bf97192c1b7c8aa7b532553a671d3f
SHA1

1950e6a9b1322a13f22f597d792503b1519c0ea3
SHA256

d98cc9cf69b669bc7b7b561730ac179df4e099ddab3c35ec1dadd242b1245825
SHA512

38315d73bde3aebb7ebe0573cca7c8059d58617d81b7491195b4faa08ea776c97e25b01023899b11f3d618870aa94b626bac33bb765bf7e864e6c43c26222076
SSDEEP

6144:jR0dYj/cf0rfBYBDkKZWGZFySiE80Sd4MVFWVEzx/oB0A:jRP/cfOfBYGKEGbyrzHqkIE1/ex

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1956	84bf97192c1b7c8aa7b532553a671d3f_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\H@tKeysH@@k.DLL	84bf97192c1b7c8aa7b532553a671d3f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\H@tKeysH@@k.DLL	84bf97192c1b7c8aa7b532553a671d3f_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	84bf97192c1b7c8aa7b532553a671d3f_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1956	84bf97192c1b7c8aa7b532553a671d3f_JaffaCakes118.exe
1956	84bf97192c1b7c8aa7b532553a671d3f_JaffaCakes118.exe
1956	84bf97192c1b7c8aa7b532553a671d3f_JaffaCakes118.exe
1956	84bf97192c1b7c8aa7b532553a671d3f_JaffaCakes118.exe
1956	84bf97192c1b7c8aa7b532553a671d3f_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\84bf97192c1b7c8aa7b532553a671d3f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\84bf97192c1b7c8aa7b532553a671d3f_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\H@tKeysH@@k.DLL

Filesize
20KB

MD5
116ec20265b00cfe389518e2a0c7ed81

SHA1
d04c903ef681bb18dbf337ffa7ff2a9ccc8bedd6

SHA256
ef9d09e51c42bc04d48444b2517471ea07f2d8a6a6a2e67dd635b7bf95bf8b7a

SHA512
594f32c4e51a87294bcfa1735254d04d5d43a38ad2ab7a39f7157bac75b959ee327053df79ee2993a8a2f4e9faafb5c8868283ae2bac8745cb916d5565171cef

Download Submit