7286b2203b0baad8e72c795721e9de5845caa9d1171f58c3058dcb0cc026aee0

Analysis

max time kernel
133s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2024, 14:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bc33b0b79eb40b9f70627161f2784618_JaffaCakes118.exe
Size

257KB
MD5

bc33b0b79eb40b9f70627161f2784618
SHA1

e3402cb91bf7410269c2ca4ba41f2a9c8d23aa32
SHA256

7286b2203b0baad8e72c795721e9de5845caa9d1171f58c3058dcb0cc026aee0
SHA512

d0805b25bd06df255332f0cbd660b01356e8ad9b06aa4bc61a19093e993ab7ad4e96d75f769af96f9d7e5159edacefd0851c7f2aefc625160703171df1e92585
SSDEEP

6144:xupehZashU5nflui6Ghu+9cxE3Sk1yf4osYJYmut+l:xup6ZawOluintcxE3XEf4t8Ymucl

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
2652	bc33b0b79eb40b9f70627161f2784618_JaffaCakes118.exe
2652	bc33b0b79eb40b9f70627161f2784618_JaffaCakes118.exe
2652	bc33b0b79eb40b9f70627161f2784618_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bc33b0b79eb40b9f70627161f2784618_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\bc33b0b79eb40b9f70627161f2784618_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\bc33b0b79eb40b9f70627161f2784618_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\DC66868C\_Setup.dll

Filesize
133KB

MD5
6780cbfe8a00dfb0fd66a2f2921b861f

SHA1
ca963a665a4699e126971c944039989d74168107

SHA256
6a1b7be06b61f21caaf6d069b32ff5c3fcbdb34d6c1ea447dfeeb980897fb6f0

SHA512
3875ca1b0de52420640e6a6fec47a363ca979e375e7a7a3223e1c8626a295cf24f20e5467d0574d9c9d7b774d4767426ee8d218158ef2208ffb5b667989f6ee7

Download Submit
C:\Users\Admin\AppData\Local\Temp\DC66868C\_Setupx.dll

Filesize
21KB

MD5
79bdae6bf1497f7e1f6bad05a44da19c

SHA1
03629f5055dcee367df53b9a4c2e0ea7d88826f7

SHA256
6920935d587867d0c54cf7b9d490765a91a947458479a5e8e77cf34549f4b0ae

SHA512
71676cdee69e07ae890c026999da2b76b95eea12269ca9555a9254c2e08f447c8ea79b6661b62c2fe55574e405b9f1ca4e6fb45aa128c819e48c8454ad5e5b14

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tsu-0A5C.dll

Filesize
249KB

MD5
f196ceecc431d7a7572803ee9d8a5784

SHA1
d6eeaffb187cd3e7e652e467ee19c511df2b0139

SHA256
a023717f0b7ba0f0ce487dde5be59b014148939e9499df0c9fdf39c8dc2babe9

SHA512
225cc4287e412df48c6de30930a718f263cd6b3df502fe88ff01dc4aac97d022881448234d1594b01da2e96ed2a31fe351825bfda314324c2b2c99011aad5828

Download Submit