166d1897ae08004f1ecdbfe79d3029b55fadd60a9521b84cba083c282be34038

Analysis

max time kernel
143s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/09/2024, 12:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d64e1b9d4c3eef539d881c484f0bccde_JaffaCakes118.exe
Size

2.0MB
MD5

d64e1b9d4c3eef539d881c484f0bccde
SHA1

61f84335e9149a862def2d86e85c3786073837f4
SHA256

166d1897ae08004f1ecdbfe79d3029b55fadd60a9521b84cba083c282be34038
SHA512

7bea412b1de51e972f9285419dfef36cfffe85405b37d0c66e823b16e5ea896a4969ff506c50fc6a7499f1f9d6151fab9bdff01a2b510ea7b4d51d078aa5c7f1
SSDEEP

49152:LMwKBmF54Fm3uTeLMBW1wZvMxPcOe5HFi:LM9+5Km3RwZEiOe5w

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
448	9440852

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\9440852	d64e1b9d4c3eef539d881c484f0bccde_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d64e1b9d4c3eef539d881c484f0bccde_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9440852

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
448	9440852
448	9440852
448	9440852
448	9440852

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3176 wrote to memory of 448	3176	d64e1b9d4c3eef539d881c484f0bccde_JaffaCakes118.exe	85
PID 3176 wrote to memory of 448	3176	d64e1b9d4c3eef539d881c484f0bccde_JaffaCakes118.exe	85
PID 3176 wrote to memory of 448	3176	d64e1b9d4c3eef539d881c484f0bccde_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\d64e1b9d4c3eef539d881c484f0bccde_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d64e1b9d4c3eef539d881c484f0bccde_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3176
- C:\Windows\SysWOW64\9440852
  C:\Windows\system32\\9440852 9440852
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\9440852

Filesize
1.8MB

MD5
06cd61177479373c67080121874a59a3

SHA1
cab2a9904778b06d45ce0e825678afcdf51f977b

SHA256
cd5f288e22ca7d7dda340fc100f92bf2447c71f7e76b5f7e44022e8b52266d80

SHA512
7b321463ef89e1f959229fe73974d9c8667b211054813c8d01b57f4d7568b5a0aba7f47927b8959969ea63da7f223d7fe8c21e6143abceb58cd6e34662d65547

Download Submit