5f80c4565edbccaffda63de549ef892b1fc7f0bc737276519e8369a591eff48d

Analysis

max time kernel
131s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13-09-2024 22:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

df04dae5c3af3a6f7a3be53ab075cfba_JaffaCakes118.exe
Size

286KB
MD5

df04dae5c3af3a6f7a3be53ab075cfba
SHA1

73058d1cba2ae926eb691567d1c30da1f95a2fb6
SHA256

5f80c4565edbccaffda63de549ef892b1fc7f0bc737276519e8369a591eff48d
SHA512

62a4c7cc3c5fb3ca2f4fd2a20812a87e81dce5af19c63838d375dba7f552168494ff801b33ade282429aa51ba13abdc2d0df461e87a6fa4ace80c07ec18e51c3
SSDEEP

6144:KON/vPRfq8V2t5cDt6Zo1Xzn4YrKWwMQous1XJFORS3Hg+gu9fR6DS:KO1PI8qCln4QKWwMHXzOw1gaGS

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
4968	df04dae5c3af3a6f7a3be53ab075cfba_JaffaCakes118.exe
4968	df04dae5c3af3a6f7a3be53ab075cfba_JaffaCakes118.exe
4968	df04dae5c3af3a6f7a3be53ab075cfba_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	df04dae5c3af3a6f7a3be53ab075cfba_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\df04dae5c3af3a6f7a3be53ab075cfba_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\df04dae5c3af3a6f7a3be53ab075cfba_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4056,i,12198811467968044966,17227406646827438786,262144 --variations-seed-version --mojo-platform-channel-handle=1040 /prefetch:8
1⤵
PID:3108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Tsu-1368.dll

Filesize
266KB

MD5
18e2b933c45ae04ac41486e2056a6126

SHA1
379149cd309cc5155fec5b19ca1c0dc69f2240c0

SHA256
f3858e2e7a3af325ce80e0a7289a7e1fb0ef8f1859e46f508e2aa52b7a193d94

SHA512
a6d6f4c261cc8436f1d4601ef510c91ea6fb86d37243f36190cc218df0ca8a9528fe6e49734bf6692b8d1c3163839be5aecbf968f0411525ffdf6517bf4aef7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\{605B3E7E-73EA-5279-6480-77D76477CF03}\_Setup.dll

Filesize
198KB

MD5
fd405f47e4b2092d599445f1e8de7ab0

SHA1
7c9c327afccea99cf8900792e6e62643812ffc48

SHA256
2623b08c35c1abf265cb9f7f941c23be2a833a577234eb08802f0f896325dbf4

SHA512
7fd674c0ea63b5cf75e3ef3c2737679ab98ef4838373c25841d8b59a9a58d42486293044f8c2942519fbe94c873f5175fc0699ba1176fb79a0ca249cdab19ad1

Download Submit
C:\Users\Admin\AppData\Local\Temp\{605B3E7E-73EA-5279-6480-77D76477CF03}\_Setupx.dll

Filesize
28KB

MD5
228722b118082a17ea16789d2cc38ee1

SHA1
4d840f5eea2a71ea27f60fb235145a683650da80

SHA256
591c3695f1c11acd7f2d67b449bbd10f6a72457f7a27146c26ac4d79ad5b37d2

SHA512
a1cb62594c03e0832b0b671f602ca45deb059a326a176b8e6d294da490f61e7972a12447c41bcbb5da163a544e9a1160043b29866383131f8e6574ee13592dc8

Download Submit