3470a4b531f8317d287968e58a4fa52c7ddf2b9a84b35d7519b6f118b9910d21

Analysis

max time kernel
140s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29-08-2024 11:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c8bdcdab7dbc7bda2e28f91966adf37e_JaffaCakes118.exe
Size

220KB
MD5

c8bdcdab7dbc7bda2e28f91966adf37e
SHA1

946010b0bb60a608f93621191f318c29c65c0f6e
SHA256

3470a4b531f8317d287968e58a4fa52c7ddf2b9a84b35d7519b6f118b9910d21
SHA512

2449047291236352e8e664b346fe033475b633571312028173be2e61dcf8638c2c80007845fdd12bd5a0022cede66761b8275d989ac88f6725db2ff27800edf0
SSDEEP

3072:szQrOhA5pBnrOrqZpNBzXiQdu9Mfj4fLz3:s0rOm/fvd374f

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2616	c8bdcdab7dbc7bda2e28f91966adf37e_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c8bdcdab7dbc7bda2e28f91966adf37e_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2616	c8bdcdab7dbc7bda2e28f91966adf37e_JaffaCakes118.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2616	c8bdcdab7dbc7bda2e28f91966adf37e_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2616	c8bdcdab7dbc7bda2e28f91966adf37e_JaffaCakes118.exe
2616	c8bdcdab7dbc7bda2e28f91966adf37e_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\c8bdcdab7dbc7bda2e28f91966adf37e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c8bdcdab7dbc7bda2e28f91966adf37e_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\UKHook35.dll

Filesize
32KB

MD5
9301b67cd8c392f7bf5fad27c7b8120e

SHA1
1bee48992462ae94c037487e951969e8d82a6c1f

SHA256
4aecfbc2b1946aedfbd1179ba5cb182305ca13ced0321d1a810f5887525413d0

SHA512
5374d0fdefc97421023a68666bb1e345fb54ba003e65e588c38beb7cd0463ae15060dec484263c057a7f628d6cf5452c3dd59eb749c5e47acd760b9a7362762f

Download Submit
memory/2616-0-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2616-5-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download