927aab22209d8d14111426517796640e33dab047f8e6f9e9ba6e39e39b68f226

Analysis

max time kernel
94s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/09/2024, 03:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ce9148154fcec18fccc0ca50d5b61bf0_JaffaCakes118.exe
Size

44KB
MD5

ce9148154fcec18fccc0ca50d5b61bf0
SHA1

8a2e40fde8fc96a6916b29a14882a76529260f9b
SHA256

927aab22209d8d14111426517796640e33dab047f8e6f9e9ba6e39e39b68f226
SHA512

6185225d7001b711af99383c45f4b3b4d1431c36f3748a61ff417e1ac9ff52339c09648a811222172e75fec224258f8630d73eb502aba2b0545acff7162a650b
SSDEEP

768:DOOjkbzPCmxYtBrVLpRQuMdsOCxIGLgRqmt0rRyvwbRoZ7uPtsNOsrSns:mfCn/RpEJCxNk+c4bRoZ7u1sNOoB

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2648	ce9148154fcec18fccc0ca50d5b61bf0_JaffaCakes118.exe
2648	ce9148154fcec18fccc0ca50d5b61bf0_JaffaCakes118.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\SysInfo.wmp	ce9148154fcec18fccc0ca50d5b61bf0_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ce9148154fcec18fccc0ca50d5b61bf0_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2648	ce9148154fcec18fccc0ca50d5b61bf0_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\ce9148154fcec18fccc0ca50d5b61bf0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ce9148154fcec18fccc0ca50d5b61bf0_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\microsoft shared\MSInfo\SysInfo.wmp

Filesize
26KB

MD5
544e14087d67c35f9a249bbd0ae21d1e

SHA1
5b10a16ac773d4bd93f99bfec936b4354f19b042

SHA256
e31ffaa5df7ef171b56666549fbf852ece92cd9fca221cb1ab1ab213077d5363

SHA512
5af0982dc54f3ed0fcbe5575ce9c8e20be4e7743b7fe93209dabed3901c9d9dad785d7566b8cf5b99146bb158731f66e02887ec1354ba92359580b5273f111df

Download Submit
memory/2648-0-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/2648-7-0x00000000022B0000-0x00000000022F5000-memory.dmp

Filesize
276KB

Download
memory/2648-8-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/2648-9-0x00000000022B0000-0x00000000022F5000-memory.dmp

Filesize
276KB

Download