46136da3b8607b6c7da8c52051bca125e20b79ca10f3521eba673ac6ba24b8d4

Analysis

max time kernel
95s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240910-en
resource tags

arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
submitted
12/09/2024, 04:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

dbcf99a00a7a1ed16f2a65836fe5df1c_JaffaCakes118.exe
Size

680KB
MD5

dbcf99a00a7a1ed16f2a65836fe5df1c
SHA1

36b4fb109f4b85306217cf40271e9572b1cacd07
SHA256

46136da3b8607b6c7da8c52051bca125e20b79ca10f3521eba673ac6ba24b8d4
SHA512

7589aec06f17274cc3fd866b87a39c18ee86e3bf11cca40b8b49c98feda8cb3cb10dc53964783cca1a3421d0cd2f760059eaf59a5b79e490a06fdc67a5abf883
SSDEEP

12288:yh7k98XaihRM8n6Tdm3/jCujQzyaa18mYQXWqn4QGTz/52NQ1x:yh7k9ERZ2dm3/6ya7mYQGhz/5p1x

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
552	dbcf99a00a7a1ed16f2a65836fe5df1c_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbcf99a00a7a1ed16f2a65836fe5df1c_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
552	dbcf99a00a7a1ed16f2a65836fe5df1c_JaffaCakes118.exe
552	dbcf99a00a7a1ed16f2a65836fe5df1c_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
552	dbcf99a00a7a1ed16f2a65836fe5df1c_JaffaCakes118.exe
552	dbcf99a00a7a1ed16f2a65836fe5df1c_JaffaCakes118.exe
552	dbcf99a00a7a1ed16f2a65836fe5df1c_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\dbcf99a00a7a1ed16f2a65836fe5df1c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\dbcf99a00a7a1ed16f2a65836fe5df1c_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\E_N4\krnln.fnr

Filesize
1.0MB

MD5
4b30dbe1a79b2b7572ff637cb3765ced

SHA1
b08eba0e9bdb62d426db8d2b3d451152a56f79a1

SHA256
4208bdf90e97398a452d459d89562bda361bc6e911a385c4e31481a776f69e6d

SHA512
40e99c4a9d160a734a1675d75209dd88c7389c95cf0d0b6101f7e9edb2f3ebfe85e7170f0f4bae8a2e9533048bd5ecd414797b02ef257aecd90431f0c29ccfce

Download Submit
memory/552-0-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/552-7-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download