fa17750f30c7992a1dfc8acdf8e62bbd7bf05c4820513d712995a986c4e29b10

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20-08-2024 14:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

af95ed83f9e0b75bb444456cd7475f53_JaffaCakes118.exe
Size

28KB
MD5

af95ed83f9e0b75bb444456cd7475f53
SHA1

5b8e2d9ecd97ad769dd787a96ee976ea445628fd
SHA256

fa17750f30c7992a1dfc8acdf8e62bbd7bf05c4820513d712995a986c4e29b10
SHA512

9f9d74f9fa3f216a2efa3bc44bf8a43048a8f4ca99a131bf64d7b7055b8d5ec11dd06b99b7875b6224b977682a6b14137b6ee43264b757153666f72ac60bc5aa
SSDEEP

384:/TfHDfihDXsb4lua6Gl+PIfD9S7oEhDXs/f:/jjycWP6GleIrs8wc3

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	af95ed83f9e0b75bb444456cd7475f53_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1084	af95ed83f9e0b75bb444456cd7475f53_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1084 wrote to memory of 3528	1084	af95ed83f9e0b75bb444456cd7475f53_JaffaCakes118.exe	86
PID 1084 wrote to memory of 3528	1084	af95ed83f9e0b75bb444456cd7475f53_JaffaCakes118.exe	86
PID 1084 wrote to memory of 3528	1084	af95ed83f9e0b75bb444456cd7475f53_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\af95ed83f9e0b75bb444456cd7475f53_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\af95ed83f9e0b75bb444456cd7475f53_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1084
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen C:\Documents and Settings\All Users\Documentos\Minhas imagens\Amostras de imagens\Ninféias.jpg
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads