29d98c2e097585ddbf33a45f924e50a12447f668fc7e2327c3dba7b70a2926a6

Analysis

max time kernel
150s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/08/2024, 09:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c07401b2321fe0497194313a2309e560_JaffaCakes118.exe
Size 68KB
Sample240825-lkyleaygnj
SHA256 29d98c2e097585ddbf33a45f924e50a12447f668fc7e2327c3dba7b70a2926a6
MD5 c07401b2321fe0497194313a2309e560
SHA1 14038e3b2d34742d7f16a08095318a3f0b7232b4
SHA512 2ac644c8edb341a281011458cede3be2af654a7b6834e4d819155df181d1c68fa69a823d83d91652eafd0b600cad8ed183faef1ef67c4ebc5bc7a60144efbed2
SSDEEP 768:6GXQrYm80cFi3ZXeJvSlePOaxeLjPcPIJazW25rwD:6GmMYEJSle2aQLjP1D
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\c07401b2321fe0497194313a2309e560_JaffaCakes118 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\c07401b2321fe0497194313a2309e560_JaffaCakes118.exe"	c07401b2321fe0497194313a2309e560_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c07401b2321fe0497194313a2309e560_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4008	c07401b2321fe0497194313a2309e560_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\c07401b2321fe0497194313a2309e560_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c07401b2321fe0497194313a2309e560_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads