16e900fb987abd62a7a0a2701634272856876ce7403512e2d8cca6fc5bdc2808

Analysis

max time kernel
97s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/08/2024, 22:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

acc1b141a5718532d5aeed9c34d523c7_JaffaCakes118.exe
Size

300KB
MD5

acc1b141a5718532d5aeed9c34d523c7
SHA1

dc2e9802cb598caafecf792413529a5e00b55f45
SHA256

16e900fb987abd62a7a0a2701634272856876ce7403512e2d8cca6fc5bdc2808
SHA512

5be08bf4db3ef6673fbc53fb9ac496cabfa08a78b344541d25af9ee0bc0af50c67006c395c5960121fbc919669c1d8146b60673cd1df65e90774c5b5ac50de39
SSDEEP

6144:jR0BYj/cf0rfBYBDkKZWGZF3E1OfFU0AC:jRP/cfOfBYGKEGb3DfyxC

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
4540	acc1b141a5718532d5aeed9c34d523c7_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\H@tKeysH@@k.DLL	acc1b141a5718532d5aeed9c34d523c7_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\H@tKeysH@@k.DLL	acc1b141a5718532d5aeed9c34d523c7_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	acc1b141a5718532d5aeed9c34d523c7_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4540	acc1b141a5718532d5aeed9c34d523c7_JaffaCakes118.exe
4540	acc1b141a5718532d5aeed9c34d523c7_JaffaCakes118.exe
4540	acc1b141a5718532d5aeed9c34d523c7_JaffaCakes118.exe
4540	acc1b141a5718532d5aeed9c34d523c7_JaffaCakes118.exe
4540	acc1b141a5718532d5aeed9c34d523c7_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\acc1b141a5718532d5aeed9c34d523c7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\acc1b141a5718532d5aeed9c34d523c7_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\H@tKeysH@@k.DLL

Filesize
20KB

MD5
116ec20265b00cfe389518e2a0c7ed81

SHA1
d04c903ef681bb18dbf337ffa7ff2a9ccc8bedd6

SHA256
ef9d09e51c42bc04d48444b2517471ea07f2d8a6a6a2e67dd635b7bf95bf8b7a

SHA512
594f32c4e51a87294bcfa1735254d04d5d43a38ad2ab7a39f7157bac75b959ee327053df79ee2993a8a2f4e9faafb5c8868283ae2bac8745cb916d5565171cef

Download Submit