5aaad568fb2b6f05e72c9876ad04800571d9fd34a98d3651afcb0e3f429959a0

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 04:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea8d99fab6d53e165f448a72c76645ff_JaffaCakes118.exe
Size

96KB
MD5

ea8d99fab6d53e165f448a72c76645ff
SHA1

30ebbbef049064c5e2cee76bfa720229e0b66fa6
SHA256

5aaad568fb2b6f05e72c9876ad04800571d9fd34a98d3651afcb0e3f429959a0
SHA512

04458b59ff364a4f26b14e4142e4b16ddfbe3fe59b52882e9251efc9f00453d4caa7f8e62d44e48343708347941c9bb493635dd3db208f38b1e578e6eb7dd7d2
SSDEEP

1536:xowahuA0ipMAgciDeT2mFnToIf62MNFyxTX1Ab:xowahJ0y5iDeT2mtTBf6NNFyxTXGb

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4308	svmssc.exe

Executes dropped EXE 1 IoCs

pid	Process
4308	svmssc.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Explorer\svmssc.exe	ea8d99fab6d53e165f448a72c76645ff_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Explorer\svmssc.exe	ea8d99fab6d53e165f448a72c76645ff_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Explorer	ea8d99fab6d53e165f448a72c76645ff_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ea8d99fab6d53e165f448a72c76645ff_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svmssc.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4124	ea8d99fab6d53e165f448a72c76645ff_JaffaCakes118.exe
4308	svmssc.exe

C:\Users\Admin\AppData\Local\Temp\ea8d99fab6d53e165f448a72c76645ff_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ea8d99fab6d53e165f448a72c76645ff_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4124

C:\Program Files\Microsoft Explorer\svmssc.exe
"C:\Program Files\Microsoft Explorer\svmssc.exe"
1⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Microsoft Explorer\svmssc.exe

Filesize
13.1MB

MD5
5bc0483108a997d091378609f8d63aca

SHA1
88cc7d713c807d0dfa54944b8d81348771ea6039

SHA256
c707491e1f8b9826f830f863a1a4db01ba44c5f68e084dd15f0d68974478643f

SHA512
6352d144aee2717c21818ecf7a274a4e03d50abbb60f145f61649bf2f926ec83dac19b6f7224636165cd7b8678222e775c0c0dbe19b3de98d60e07dd6b56f722

Download Submit
C:\SystemTemp

Filesize
84B

MD5
8cf67a47c6438c196e8affb87263f86f

SHA1
0c099be6a723166fce558e101070cef8d1576eac

SHA256
7a4f6c4ca1b0e3ab7d18195b179cb6ca99c6263648d783f099637f89c89b2f49

SHA512
29bdab2e80d4b3233bf387209374158af2217fff986d9cdea20d0e286fdae0a996dd650f80ef2b17cd4385a17962d965e7c7ef1da63ca7c4f5432cae7c88e1b2

Download Submit