9e3077f1ed80d343810a01f518b80a57a8343127625f35d5a088bbacc92f1370

Analysis

max time kernel
92s
max time network
108s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13/09/2024, 02:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dd76852fa64085f38f5b04ae77a1ed55_JaffaCakes118.exe
Size

135KB
MD5

dd76852fa64085f38f5b04ae77a1ed55
SHA1

c80f06a584394d263b82a60f26aa58ec729eb172
SHA256

9e3077f1ed80d343810a01f518b80a57a8343127625f35d5a088bbacc92f1370
SHA512

6ca1763cfdcacce6910aad571271828ebf4458bccbccec57a01c46de4b664563bf4e90cf6df158ed6b20be56273382f5188fe74f1162536434de37b265b831e9
SSDEEP

3072:IxTqpdA3f6QNf2IPO4DpmWpAsfYbTOBoefYi6a9k20tA3Z/ccqcPJ2g:q2pdqfv2IPOGfXf5ovWJUKPJb

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\dextor32.exe	dd76852fa64085f38f5b04ae77a1ed55_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dd76852fa64085f38f5b04ae77a1ed55_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\dd76852fa64085f38f5b04ae77a1ed55_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\dd76852fa64085f38f5b04ae77a1ed55_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Temp\CKY3 - Bam Margera World Industries Alien Workshop Full Downloader.exe

Filesize
135KB

MD5
dd76852fa64085f38f5b04ae77a1ed55

SHA1
c80f06a584394d263b82a60f26aa58ec729eb172

SHA256
9e3077f1ed80d343810a01f518b80a57a8343127625f35d5a088bbacc92f1370

SHA512
6ca1763cfdcacce6910aad571271828ebf4458bccbccec57a01c46de4b664563bf4e90cf6df158ed6b20be56273382f5188fe74f1162536434de37b265b831e9

Download Submit
memory/3188-101-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download