90bb58bf8296e8f7a6cdce628c92199d8f1fab9c71274b7b744329403986763d

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/09/2024, 00:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ce35da1a407c4141d585ba36c6e9f6ba_JaffaCakes118.exe
Size

390KB
MD5

ce35da1a407c4141d585ba36c6e9f6ba
SHA1

aa0264e52d729c795db55cb56e5bddb6dca7c2fa
SHA256

90bb58bf8296e8f7a6cdce628c92199d8f1fab9c71274b7b744329403986763d
SHA512

c51ba060c7bab13c92f22d9c4bcb9cd9db9a0de0bc6356366a8f4d52c39227f44c5ef197588d73020e57ccea4c83464eff3a78e2b8b9514a52b8f9f017d59077
SSDEEP

6144:OS6pEDNztbRJpGEa3oYj4nfA9S+EmGG82o4GCCdKjBOyaRawf7qUlO9e7JyX4BcO:OS3NhIPYYE49Se82bBFbwfeboJyouO

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ce35da1a407c4141d585ba36c6e9f6ba_JaffaCakes118.exe

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ce35da1a407c4141d585ba36c6e9f6ba_JaffaCakes118.MyNSHandler\ = "this is my ebook"	ce35da1a407c4141d585ba36c6e9f6ba_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}\ProgID\ = "ce35da1a407c4141d585ba36c6e9f6ba_JaffaCakes118.MyNSHandler"	ce35da1a407c4141d585ba36c6e9f6ba_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}\LocalServer32	ce35da1a407c4141d585ba36c6e9f6ba_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}\ = "this is my ebook"	ce35da1a407c4141d585ba36c6e9f6ba_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ce35da1a407c4141d585ba36c6e9f6ba_JaffaCakes118.exe"	ce35da1a407c4141d585ba36c6e9f6ba_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ce35da1a407c4141d585ba36c6e9f6ba_JaffaCakes118.MyNSHandler	ce35da1a407c4141d585ba36c6e9f6ba_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ce35da1a407c4141d585ba36c6e9f6ba_JaffaCakes118.MyNSHandler\Clsid	ce35da1a407c4141d585ba36c6e9f6ba_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ce35da1a407c4141d585ba36c6e9f6ba_JaffaCakes118.MyNSHandler\Clsid\ = "{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}"	ce35da1a407c4141d585ba36c6e9f6ba_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}\ProgID	ce35da1a407c4141d585ba36c6e9f6ba_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}	ce35da1a407c4141d585ba36c6e9f6ba_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4928	ce35da1a407c4141d585ba36c6e9f6ba_JaffaCakes118.exe
4928	ce35da1a407c4141d585ba36c6e9f6ba_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\ce35da1a407c4141d585ba36c6e9f6ba_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ce35da1a407c4141d585ba36c6e9f6ba_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4928-0-0x0000000002230000-0x0000000002231000-memory.dmp

Filesize
4KB

Download
memory/4928-2-0x0000000002230000-0x0000000002231000-memory.dmp

Filesize
4KB

Download
memory/4928-1-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download