883e54a563eec3b8ed12a17cb5425ce76a657fcbc5ff88cb3e88bcadfed222bb

Analysis

max time kernel
139s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
22/08/2024, 06:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b698d78ee10f73b088f06132c23fc815_JaffaCakes118.exe
Size 285KB
Sample240822-grjcvasbkg
SHA256 883e54a563eec3b8ed12a17cb5425ce76a657fcbc5ff88cb3e88bcadfed222bb
MD5 b698d78ee10f73b088f06132c23fc815
SHA1 28dabc6356343f1769abd3e5e9bc35fc94b823e1
SHA512 1b6399405456088b036349ec8a069408cf0bdfe3098930ddb47661ecd03b366e479973c01ad995a18c677e6325581e4acb1deee60c6443e3f7c638722f25ec69
SSDEEP 6144:GW9pwwKeFqzDNQkoSt3g3+gJAAKpsfy7Zy9HsN9XNUh0uTDq4j:GWQwxCQEtj6AhmyVKsNtNU2uTDq4j
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
4400	b698d78ee10f73b088f06132c23fc815_JaffaCakes118.exe
4400	b698d78ee10f73b088f06132c23fc815_JaffaCakes118.exe
4400	b698d78ee10f73b088f06132c23fc815_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b698d78ee10f73b088f06132c23fc815_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\b698d78ee10f73b088f06132c23fc815_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b698d78ee10f73b088f06132c23fc815_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Tsu-1130.dll

Path C:\Users\Admin\AppData\Local\Temp\Tsu-1130.dll
Size 266KB
SHA256 67953edefcc531c39a3dbfad73c2cc1ea4298fdeebdc618bc94e4f4910e20557
MD5 7d27513f24c9cfb26d52318579eb46c5
SHA1 723e143340e75fbf18e14a418c6057183ab0239d
SHA512 738ccda7c32d251fc8fa8f102be437f9e9108a6aadfa6a7e98c7f9521ed5a09f1deb0e9ae86b73c0e8097b13afd50d791f261e78cc20ff36ef215e73db02592c
SSDEEP 3072:s+b0smOcD1Wgrd04Ao+bh9sL8j8XKpuViHH/f6H/CeHNmGlCRg63i/TWIx7IIdBE:Dox8mVAoghpgkPXjetng3i/iIxxa3yZg
MD5 SHA1 SHA512 SSDEEP

Submit Download

_Setup.dll

Path C:\Users\Admin\AppData\Local\Temp\{020C8468-BC9F-0322-35DB-B8A206207515}\_Setup.dll
Size 200KB
SHA256 232ce4fcb936611625b80778f52f94597094a63d6e48bed248d97180d930bba5
MD5 a822ea7564b483cf6b1d5bb384fae55b
SHA1 48e9c70df0b247ae2112e70664f18c1c89643d6b
SHA512 312c3580d676f8c802d69c2aaa9e6d2e69a282749115234994f343a790038232fcfff03f9cc691e680e2f28023deab2fc614881d8b90fdaff372787483dcf47c
SSDEEP 3072:VtpORKZmYOxaHbpmOIEbUPOZuzYv/0jcdP0AKE3Q6ZjTh86ELfRHCukAlRHzAMHa:ROUmZ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

_Setupx.dll

Path C:\Users\Admin\AppData\Local\Temp\{020C8468-BC9F-0322-35DB-B8A206207515}\_Setupx.dll
Size 28KB
SHA256 591c3695f1c11acd7f2d67b449bbd10f6a72457f7a27146c26ac4d79ad5b37d2
MD5 228722b118082a17ea16789d2cc38ee1
SHA1 4d840f5eea2a71ea27f60fb235145a683650da80
SHA512 a1cb62594c03e0832b0b671f602ca45deb059a326a176b8e6d294da490f61e7972a12447c41bcbb5da163a544e9a1160043b29866383131f8e6574ee13592dc8
SSDEEP 384:50WJIDwq5xCy4iOAf72eLHLHgfEv2JNfTy3fl6IDeZZ5OeFi3OmJ6NanW8r7Eq4S:50HD/CgfXLWPQfsz2b6kd+nAcMT8m
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads