edca18fd811c2773d152204343370c522e6af8c9e238f6a38a742c0eb852455d

Analysis

max time kernel
140s
max time network
117s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 07:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eada5454f3b15a8201b446c498fce83b_JaffaCakes118.exe
Size

19KB
MD5

eada5454f3b15a8201b446c498fce83b
SHA1

dc1ae85e084332f31e43343e2b405bbc932ba8f6
SHA256

edca18fd811c2773d152204343370c522e6af8c9e238f6a38a742c0eb852455d
SHA512

eb354d17bb3a1e50b3043ccc64700b68d8611b18cf96ca2c25340e0597eee0f4f7f1b547967a59c9012d0499b6920c528645d69401c5eaee97820061c6614a36
SSDEEP

384:6q7U6GOuIUA/srisQV1qkIAMEgv9T2rJFD3Vn3mb55fUTptp:T7U6GjXkbgv6JtV3LTp

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
3256	eada5454f3b15a8201b446c498fce83b_JaffaCakes118.exe
3256	eada5454f3b15a8201b446c498fce83b_JaffaCakes118.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\dddowner.vxd	eada5454f3b15a8201b446c498fce83b_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eada5454f3b15a8201b446c498fce83b_JaffaCakes118.exe

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{92B1E726-2CEF-1445-8768-7695C7C9925F}\InProcServer32\ = "C:\\Windows\\SysWow64\\dddowner.vxd"	eada5454f3b15a8201b446c498fce83b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{92B1E726-2CEF-1445-8768-7695C7C9925F}\InProcServer32\ThreadingModel = "Apartment"	eada5454f3b15a8201b446c498fce83b_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{92B1E726-2CEF-1445-8768-7695C7C9925F}	eada5454f3b15a8201b446c498fce83b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{92B1E726-2CEF-1445-8768-7695C7C9925F}\	eada5454f3b15a8201b446c498fce83b_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{92B1E726-2CEF-1445-8768-7695C7C9925F}\InProcServer32	eada5454f3b15a8201b446c498fce83b_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\eada5454f3b15a8201b446c498fce83b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eada5454f3b15a8201b446c498fce83b_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\dddowner.vxd

Filesize
23KB

MD5
cf95f8b8d20e0a2d15f12d3026f6cdb3

SHA1
a3772e6af992a3d89f24cbd33fae4dccf87b4336

SHA256
e233680906007c1d3fc86ae5b08f340099f4f8c90854271e561a25e15d1a332c

SHA512
d5108a237230e37c90dcb615b36508d1a99ffac8fdf8b4a5324f2ca2db3c8b74829310b2a6de00fb396db8a45f709fcd90c0bfc96e8410712a0ef4a5af6a3717

Download Submit
memory/3256-0-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3256-1-0x00000000004E0000-0x00000000004E1000-memory.dmp

Filesize
4KB

Download
memory/3256-6-0x00000000004E0000-0x00000000004EB000-memory.dmp

Filesize
44KB

Download
memory/3256-9-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3256-10-0x00000000004E0000-0x00000000004EB000-memory.dmp

Filesize
44KB

Download
memory/3256-11-0x00000000004E0000-0x00000000004E1000-memory.dmp

Filesize
4KB

Download