bc1816a727d752d3ae648d00358893f2e3c3bb2fbbd3b9499ed51ae8c061e6ee

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14/08/2024, 17:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

96fa873a0d9c6dc228e1089ef9846a9c_JaffaCakes118.exe
Size

92KB
MD5

96fa873a0d9c6dc228e1089ef9846a9c
SHA1

b9ab3c5534ea71168c34c90994b363cf4cd649a2
SHA256

bc1816a727d752d3ae648d00358893f2e3c3bb2fbbd3b9499ed51ae8c061e6ee
SHA512

1189be7dffc12dabd51014a347ca74934a7c6afea4789a3082a5cca319a8f75794b58f8b4886091c1f8cbcab4eb2b9be93d548795e1973eab348bbc0ffe4a366
SSDEEP

1536:KMu7XK1u5vRZ4qTGtXR4GE3y59xeQSXwx2BgRq33M4VwQJw7y+5gj:KfbSup4FXS+9b2BgRqM4Vw97s

Score

5^/10

discovery

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\s.exe	96fa873a0d9c6dc228e1089ef9846a9c_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	96fa873a0d9c6dc228e1089ef9846a9c_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2792	96fa873a0d9c6dc228e1089ef9846a9c_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\96fa873a0d9c6dc228e1089ef9846a9c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\96fa873a0d9c6dc228e1089ef9846a9c_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\wer4o8\tmp.exe

Filesize
76KB

MD5
3244f92b8bbd0c88eeb61eecd532cc8d

SHA1
6fa954ae1a1a41c94d38e0029ab1e268fcb82779

SHA256
7e44a52ff717677c2214b8671be81c1c56cd199b813769a14583877cd1d1462e

SHA512
c5ca695ebf4d59a172d1861474ff20639d6efdbdd23fe0bdb7f2773cfdaab2d6bfb2c159781b4c5cbdbd35d2bae0f2e18a679792bdcf32c1627448e2fe6b21d2

Download Submit