ec5dd29f47d67fe8425925cc718f22f19526797c885d8cdccfa630589bd2d3e5

Analysis

max time kernel
131s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2024, 22:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f0bb966e2b25705cfaea5a961559831f_JaffaCakes118.exe
Size

2.9MB
MD5

f0bb966e2b25705cfaea5a961559831f
SHA1

27a2b997f45d0b44fc82294524ed3c08eb2fa20c
SHA256

ec5dd29f47d67fe8425925cc718f22f19526797c885d8cdccfa630589bd2d3e5
SHA512

1261e2649e90e36cfff2856d4956d3794e3f936c55f7ad920febad565748d4fcc683913d414c818928f42077f77e6c8233bb677ecd3188e46bc35a073b30afd1
SSDEEP

49152:3nGtTxTZfewbV0Rfn2mP/ZLQXKBtor+c5dAn1YjHmPE/rxChpnV3:3GtTxTZfrmnHdQXz+qyYaPEzY9

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1700	f0bb966e2b25705cfaea5a961559831f_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f0bb966e2b25705cfaea5a961559831f_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\f0bb966e2b25705cfaea5a961559831f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f0bb966e2b25705cfaea5a961559831f_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3820,i,2904906934812054273,11716976550456127484,262144 --variations-seed-version --mojo-platform-channel-handle=1424 /prefetch:8
1⤵
PID:3844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsd8038.tmp\AdvSplash.dll

Filesize
6KB

MD5
84cc150e363309a426d51c4dd76a2ae6

SHA1
ea4d02e24f1a156dc00348c7a5c88ceddbb6800b

SHA256
2c9bc7ee7e74618a4f118349a5cc1a22f2dc46d9ab0fb6e73b2cbdd1fe6c71ce

SHA512
0785d40ea56c98acfb06f6bc9b646af6208d0eef174d718429d64e3146cdcb84c244c1c9902ad53ba441efb10728039f2418dc926a9d8b82a7709cec2030569e

Download Submit