27228c21c361bb848fb33435b9a8c8f32e48e284f5919dec1a34c999bdc54582

Analysis

max time kernel
149s
max time network
116s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
15/09/2024, 09:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e22e4582ca0520fc2dae75e26b35ce0b_JaffaCakes118.exe
Size

14.2MB
MD5

e22e4582ca0520fc2dae75e26b35ce0b
SHA1

ea4ae8aa9a3462164f353258b5dfdf56a27a793f
SHA256

27228c21c361bb848fb33435b9a8c8f32e48e284f5919dec1a34c999bdc54582
SHA512

bb0a3af630dd49c27a1882d367ba2a9e7348c7d69dc2d1e830297341fff67f5f9fc7a63e6b305a997cc2e02ee379f47a5af834430628d47be7b992c1c11ca176
SSDEEP

49152:YJLc1kqIk5yFDgCRX6H4FPT0HB+ZGB/p43O7w9VFZnpu+2RJli7VS5C:Ya1p55YfRqH1xtUFNpuBRJli7VS5C

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\AntispywareBot Scheduled Scan.job	e22e4582ca0520fc2dae75e26b35ce0b_JaffaCakes118.exe
File created	C:\Windows\Tasks\AntispywareBot System Startup.job	e22e4582ca0520fc2dae75e26b35ce0b_JaffaCakes118.exe
File opened for modification	C:\Windows\Tasks\AntispywareBot Scheduled Scan.job	e22e4582ca0520fc2dae75e26b35ce0b_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e22e4582ca0520fc2dae75e26b35ce0b_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeBackupPrivilege	3296	e22e4582ca0520fc2dae75e26b35ce0b_JaffaCakes118.exe
Token: SeRestorePrivilege	3296	e22e4582ca0520fc2dae75e26b35ce0b_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3296	e22e4582ca0520fc2dae75e26b35ce0b_JaffaCakes118.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3296	e22e4582ca0520fc2dae75e26b35ce0b_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3296	e22e4582ca0520fc2dae75e26b35ce0b_JaffaCakes118.exe
3296	e22e4582ca0520fc2dae75e26b35ce0b_JaffaCakes118.exe
3296	e22e4582ca0520fc2dae75e26b35ce0b_JaffaCakes118.exe
3296	e22e4582ca0520fc2dae75e26b35ce0b_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\e22e4582ca0520fc2dae75e26b35ce0b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e22e4582ca0520fc2dae75e26b35ce0b_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Tasks\AntispywareBot Scheduled Scan.job

Filesize
610B

MD5
041b8405c7ae860386be398df1bbd99b

SHA1
76a4bf2623c43b49921469fe8638ce83d254fd90

SHA256
5aae1f72c4379071e55d8bb3292157dbeae6f120023981da405bb399d4b85ea5

SHA512
174031a4c67c5e3eba71784b98914ad0c3b9a6d38881a5497f3263fe7f3bac3b5205896234c52aa2b22d6c4ec17ac7e3818f145016ef2246d33d56f31498db3f

Download Submit