e4d5b3a37d143a3b99995147e05eea27432aec482802fa696d9bf05bcb837ffd

Analysis

max time kernel
96s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13/09/2024, 05:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ddba42d460127bc68b5094b0ba04c57b_JaffaCakes118.exe
Size

356KB
MD5

ddba42d460127bc68b5094b0ba04c57b
SHA1

37c8e5f4bbab15ced826cddbd024a48fcd363b3d
SHA256

e4d5b3a37d143a3b99995147e05eea27432aec482802fa696d9bf05bcb837ffd
SHA512

9156ad501d0994d6b7d219033c38b35b240896a99443283835198f9406387f957400d1ab198d09db85543d3701da059afb2d25cc05f7aa2df6425fa07757a7d0
SSDEEP

6144:JOEIocOgVfIwOkXE3txhxPfc3mvQDBwy4n6I5DW9DcGUpb/DSroD+4QFudDw6/zr:JOEIDOgVfIwOkXE3txhxPfc3mvQVwy4g

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3624	application.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\GetVersion\application.exe	ddba42d460127bc68b5094b0ba04c57b_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ddba42d460127bc68b5094b0ba04c57b_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	application.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
3520	ddba42d460127bc68b5094b0ba04c57b_JaffaCakes118.exe
3520	ddba42d460127bc68b5094b0ba04c57b_JaffaCakes118.exe
3520	ddba42d460127bc68b5094b0ba04c57b_JaffaCakes118.exe
3520	ddba42d460127bc68b5094b0ba04c57b_JaffaCakes118.exe
3624	application.exe
3624	application.exe
3624	application.exe
3624	application.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3520 wrote to memory of 3624	3520	ddba42d460127bc68b5094b0ba04c57b_JaffaCakes118.exe	83
PID 3520 wrote to memory of 3624	3520	ddba42d460127bc68b5094b0ba04c57b_JaffaCakes118.exe	83
PID 3520 wrote to memory of 3624	3520	ddba42d460127bc68b5094b0ba04c57b_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\ddba42d460127bc68b5094b0ba04c57b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ddba42d460127bc68b5094b0ba04c57b_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3520
- C:\Program Files\GetVersion\application.exe
  "C:\Program Files\GetVersion\application.exe" "33201"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\GetVersion\application.exe

Filesize
356KB

MD5
9905711f9864048a0665cd33cdc95a4f

SHA1
539cf263887c686dec36def53ce38d656a7a2a1e

SHA256
174783d70f0614ddb16737c64b35790341a29df450cd4da56cd1c78c1aaf6a7f

SHA512
f3091920b94c23925bbecbcea5a2df645c5a76cdefc3c583672839516f7a6ab7a114ba59cd1c038be06fa9b3e6c4341ab97a1a26613b38e2fc55e8fe2ea0e514

Download Submit