c3310a7eadd170f5ffca270025b5b8d56006dee1299222a4e67ff8a6685deac6

Analysis

max time kernel
140s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2024, 16:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bc6e1bd8de4de6a8969321a2f46ffa0a_JaffaCakes118.exe
Size

27KB
MD5

bc6e1bd8de4de6a8969321a2f46ffa0a
SHA1

e6d647f44a9f175d26ce351756e7592102757bd6
SHA256

c3310a7eadd170f5ffca270025b5b8d56006dee1299222a4e67ff8a6685deac6
SHA512

449ce170ae0d1b5f78900b0302a683627fc6d91f61c58008e73b94bae29bf6f32f22ed6e74c7ff8f6a68c3ad44a128dbcf584973ed75b7eab823fe6346ab7015
SSDEEP

384:oQY3rNlx872j7yZMidlQAqY9nUWfQmeEUW7wY+Dp1wk/geWOXVrwOX:pY35lGLMizqKnPfyDDXpdXVr3X

Score

5^/10

discovery

Malware Config

Signatures

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\3389ba9d.dll	bc6e1bd8de4de6a8969321a2f46ffa0a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\3389ba9d.dll	bc6e1bd8de4de6a8969321a2f46ffa0a_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bc6e1bd8de4de6a8969321a2f46ffa0a_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\bc6e1bd8de4de6a8969321a2f46ffa0a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\bc6e1bd8de4de6a8969321a2f46ffa0a_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3828-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3828-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download