bc1816a727d752d3ae648d00358893f2e3c3bb2fbbd3b9499ed51ae8c061e6ee

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/08/2024, 17:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

96fa873a0d9c6dc228e1089ef9846a9c_JaffaCakes118.exe
Size

92KB
MD5

96fa873a0d9c6dc228e1089ef9846a9c
SHA1

b9ab3c5534ea71168c34c90994b363cf4cd649a2
SHA256

bc1816a727d752d3ae648d00358893f2e3c3bb2fbbd3b9499ed51ae8c061e6ee
SHA512

1189be7dffc12dabd51014a347ca74934a7c6afea4789a3082a5cca319a8f75794b58f8b4886091c1f8cbcab4eb2b9be93d548795e1973eab348bbc0ffe4a366
SSDEEP

1536:KMu7XK1u5vRZ4qTGtXR4GE3y59xeQSXwx2BgRq33M4VwQJw7y+5gj:KfbSup4FXS+9b2BgRqM4Vw97s

Score

5^/10

discovery

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\s.exe	96fa873a0d9c6dc228e1089ef9846a9c_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	96fa873a0d9c6dc228e1089ef9846a9c_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5048	96fa873a0d9c6dc228e1089ef9846a9c_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\96fa873a0d9c6dc228e1089ef9846a9c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\96fa873a0d9c6dc228e1089ef9846a9c_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\eztjzz0\tmp.exe

Filesize
84KB

MD5
89858f5bcd19c427cebb6b324af06955

SHA1
7d1f98a9735b6de0f2dae96637b6e344bfb9f710

SHA256
7a634d263df924a20bc3604e8a0ac1081de41ae6c5a626a966d78ff94883597e

SHA512
c9ce72ec139177ba63d5c60ff5ef417a883ad364e4ac5d8e946dc5e9f96eb9e8c85582ef7baeb56c28db6f6817b310e5cd7c7a4f76af778a2c3c7485f20c23fa

Download Submit