5805b9c3304b202ca6e1c3bbdb01026f23a54fac1ea2b258fc293e5e386d781d

Analysis

max time kernel
136s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/08/2024, 10:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aab49c3bbc14d1db8984c4cb0f8d0279_JaffaCakes118.exe
Size

122KB
MD5

aab49c3bbc14d1db8984c4cb0f8d0279
SHA1

974fe640208c84e4e71fe8fd4e241acfbd1b6716
SHA256

5805b9c3304b202ca6e1c3bbdb01026f23a54fac1ea2b258fc293e5e386d781d
SHA512

91fcb1ad6b34027f944e5fc3e64ea6adf9fe7a67c322b88ec5a584008555e4e24ed2c5a5bea459158a6a2451b79958b7ef8beae423f547db0d27ea170d5d9297
SSDEEP

3072:0aFQEsJq41p7lBJBa7f/dQDDmNiCCfFgi503+B3:9FQEsJq41phBJ0/kCNLigjg3

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aab49c3bbc14d1db8984c4cb0f8d0279_JaffaCakes118.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	aab49c3bbc14d1db8984c4cb0f8d0279_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	aab49c3bbc14d1db8984c4cb0f8d0279_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	aab49c3bbc14d1db8984c4cb0f8d0279_JaffaCakes118.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	aab49c3bbc14d1db8984c4cb0f8d0279_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	aab49c3bbc14d1db8984c4cb0f8d0279_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2324	aab49c3bbc14d1db8984c4cb0f8d0279_JaffaCakes118.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2324	aab49c3bbc14d1db8984c4cb0f8d0279_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\aab49c3bbc14d1db8984c4cb0f8d0279_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\aab49c3bbc14d1db8984c4cb0f8d0279_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads