cde6cf494da932e219e033a65f12afefa00792351f1aed30257109bf45d78755

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18/08/2024, 21:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a833b85e929be923537f78905a382c37_JaffaCakes118.exe
Size

476KB
MD5

a833b85e929be923537f78905a382c37
SHA1

0462f6e2e2d7a74d18e0d0b32d6a358c8a05de2b
SHA256

cde6cf494da932e219e033a65f12afefa00792351f1aed30257109bf45d78755
SHA512

80164880b33435e36146f2651b06a08660b1d7bf9e68959b4711a18ab154ba5375e234c40edb9e5be2eeb00216dd9c46e6d615c0e75ed5b55c489ffe1e167069
SSDEEP

6144:TjtisVV/LU/lgx0TJV//gBiRt9KxMtmkA2R3ddr92gjr2Shyk5lYw9J1WV/:f1VTju/L9wod0utX5+w9zI

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a833b85e929be923537f78905a382c37_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1932	a833b85e929be923537f78905a382c37_JaffaCakes118.exe
1932	a833b85e929be923537f78905a382c37_JaffaCakes118.exe
1932	a833b85e929be923537f78905a382c37_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 4380	1932	a833b85e929be923537f78905a382c37_JaffaCakes118.exe	85
PID 1932 wrote to memory of 4380	1932	a833b85e929be923537f78905a382c37_JaffaCakes118.exe	85
PID 1932 wrote to memory of 4380	1932	a833b85e929be923537f78905a382c37_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\a833b85e929be923537f78905a382c37_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a833b85e929be923537f78905a382c37_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\DSCF2332.JPG
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...