9c1e68e48f17f0a3ebe8f3df094ef0f8c747cf6ac8b16eeeea581d6c309249dd

Analysis

max time kernel
133s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
22/08/2024, 05:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b680b882c2a88afd9600c9f2aa1f1634_JaffaCakes118.exe
Size

83KB
MD5

b680b882c2a88afd9600c9f2aa1f1634
SHA1

c02d13e04010c67531ae6a5b3ed4cc9325449cac
SHA256

9c1e68e48f17f0a3ebe8f3df094ef0f8c747cf6ac8b16eeeea581d6c309249dd
SHA512

f8e09fdc53b4c1e5828ea5f39efad2e919226d4f06f560e64e50f3ccf9a064e8b9c044028d2a13e2316dc48ccf612231b10b2cb033b85383fb1737f44ecc07db
SSDEEP

1536:l6+NvPSj/Ij+j467Gg8cSBn8DpgUbD1URyQmPOLHhvZetsp7ydz3Ip1n5l+/ONJG:lDvPSj/Ij+jTGgoFgUcMLHyW7+zgx5Yz

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
3420	b680b882c2a88afd9600c9f2aa1f1634_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\olemdb32.dl_	b680b882c2a88afd9600c9f2aa1f1634_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\olemdb32.dll	b680b882c2a88afd9600c9f2aa1f1634_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b680b882c2a88afd9600c9f2aa1f1634_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3420	b680b882c2a88afd9600c9f2aa1f1634_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\b680b882c2a88afd9600c9f2aa1f1634_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b680b882c2a88afd9600c9f2aa1f1634_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\olemdb32.dll

Filesize
23KB

MD5
65387b1305f01ede9bce1b664207d5d7

SHA1
19d719d16958e6a1c5367b578cb9ff7700e695bf

SHA256
148f1d2ce99fb0305e53fd24add20cd19cc420e9c1d1b64abf42b456da94cd23

SHA512
cd64957c47979626be9a77b2a2ee2d0b22b72540369a4b6cfe1c1c9f8180b546db0b6e637259dd8f7a09506d738ec57fc34b116e199641c40f55e0d5b40a2a29

Download Submit
memory/3420-0-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3420-5-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/3420-10-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/3420-9-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download