138e776e2a99aad10d42f11aa0a9a6ab0d12ebd2708b4f6f7f0d5e1b8b459410

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
22/08/2024, 06:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b6a53e60500344af06a40fa8f9e53128_JaffaCakes118.exe
Size

95KB
MD5

b6a53e60500344af06a40fa8f9e53128
SHA1

b67056f806a69a674db073f9949e216db8f0e5bb
SHA256

138e776e2a99aad10d42f11aa0a9a6ab0d12ebd2708b4f6f7f0d5e1b8b459410
SHA512

819e323d5855d120bcf3ead55bcc20af729e23ae6f3072278a45b85a0e765e6977a3a5dc776403c248d508a874ff186da58314c255733ae8f1175f4e4f431f7e
SSDEEP

1536:B+QfuTXPjcFx+8ln6nZY/2BY0lLQq7qhFQ31J06QadXMECnw3o+6zFtPdhrFq:BcTXPjS36nTYoN71VQafCkCtPdhg

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1332	b6a53e60500344af06a40fa8f9e53128_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\olemdb32.dl_	b6a53e60500344af06a40fa8f9e53128_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\olemdb32.dll	b6a53e60500344af06a40fa8f9e53128_JaffaCakes118.exe

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File opened for modification	C:\PROGRAM FILES\7-ZIP\7zG.exe	b6a53e60500344af06a40fa8f9e53128_JaffaCakes118.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeC2RClient.exe	b6a53e60500344af06a40fa8f9e53128_JaffaCakes118.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeClickToRun.exe	b6a53e60500344af06a40fa8f9e53128_JaffaCakes118.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MavInject32.exe	b6a53e60500344af06a40fa8f9e53128_JaffaCakes118.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7z.exe	b6a53e60500344af06a40fa8f9e53128_JaffaCakes118.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7zFM.exe	b6a53e60500344af06a40fa8f9e53128_JaffaCakes118.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\Uninstall.exe	b6a53e60500344af06a40fa8f9e53128_JaffaCakes118.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\AppVShNotify.exe	b6a53e60500344af06a40fa8f9e53128_JaffaCakes118.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\InspectorOfficeGadget.exe	b6a53e60500344af06a40fa8f9e53128_JaffaCakes118.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\IntegratedOffice.exe	b6a53e60500344af06a40fa8f9e53128_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SYSTEM.INI	b6a53e60500344af06a40fa8f9e53128_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b6a53e60500344af06a40fa8f9e53128_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1332	b6a53e60500344af06a40fa8f9e53128_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\b6a53e60500344af06a40fa8f9e53128_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b6a53e60500344af06a40fa8f9e53128_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\olemdb32.dll

Filesize
23KB

MD5
65387b1305f01ede9bce1b664207d5d7

SHA1
19d719d16958e6a1c5367b578cb9ff7700e695bf

SHA256
148f1d2ce99fb0305e53fd24add20cd19cc420e9c1d1b64abf42b456da94cd23

SHA512
cd64957c47979626be9a77b2a2ee2d0b22b72540369a4b6cfe1c1c9f8180b546db0b6e637259dd8f7a09506d738ec57fc34b116e199641c40f55e0d5b40a2a29

Download Submit
memory/1332-0-0x0000000001000000-0x0000000001035000-memory.dmp

Filesize
212KB

Download
memory/1332-8-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1332-9-0x0000000001000000-0x0000000001035000-memory.dmp

Filesize
212KB

Download
memory/1332-10-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download