ed6c50070d0c6f5a14057c9f01604d664df84d90b4b49a0be0f634109a3ea2ec

Analysis

max time kernel
93s
max time network
108s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/09/2024, 10:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dff98adff741e726cc3b1b554b96de39_JaffaCakes118.exe
Size

64KB
MD5

dff98adff741e726cc3b1b554b96de39
SHA1

7dadad3f38ecd92c2827e0f03e208222f909a10d
SHA256

ed6c50070d0c6f5a14057c9f01604d664df84d90b4b49a0be0f634109a3ea2ec
SHA512

1ad2181fb0e776086f23e0973b3c16aaeaabfb605bfe856b17d9042a9a6190a05cf76dc8bf2408227a837c8e9aebf69f579451b82b9da3c3252ef1cf8a8aad22
SSDEEP

768:ZRZtivOeQRg9cNUDnefzsejesLhsuyzf+PCkT4AG1Jy2WFO7r0yllJqoNWQ:ZRZtYOucNgnGsejesLKrqbw7wyllbNd

Score

5^/10

discovery

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\s.exe	dff98adff741e726cc3b1b554b96de39_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dff98adff741e726cc3b1b554b96de39_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3352	dff98adff741e726cc3b1b554b96de39_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\dff98adff741e726cc3b1b554b96de39_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\dff98adff741e726cc3b1b554b96de39_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\r1h\tmp.exe

Filesize
144KB

MD5
259a41bcb3188cd01b97e67f9a386ed3

SHA1
2060c453511200d83407989700cb07aa678f1066

SHA256
cf4ed267c15d51faeaa493229922ed0b0b6e4a8a5371809a89e207b694235a46

SHA512
2a2616c251b4936f6cf1337b7b28b5f56d4b2c1c7c5d5844946dba1c98c2de4c49935fceee32022a60b8514a4083a33e5e205ec79c507fe33d65b831805c8bb3

Download Submit