c8cf169897093d492b462e8bfc6cf549568d42886cede23c070555beedc6269d

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/09/2024, 04:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f52a8823fc92aeb456f50df7da8c9dd6_JaffaCakes118.exe
Size

11.0MB
MD5

f52a8823fc92aeb456f50df7da8c9dd6
SHA1

1bc7a25a01e3cf95633cc83d946e642f46d36fb7
SHA256

c8cf169897093d492b462e8bfc6cf549568d42886cede23c070555beedc6269d
SHA512

23f141155dfa4801956afd63c34e0d9c267ef820f05b1c212a3297b41bd4a5faef5b67f73dcaf5915b230529ff556e9faa2960e92317ff3af3fa979773007e3d
SSDEEP

98304:PCYkkAjcg5NBKO3dgq4+DGEvQPAGyrodP8VP4MW6yLO239bxU:PH45NBKO3dW/FCrodP6P4MOLO2

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2736	TMP2584.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f52a8823fc92aeb456f50df7da8c9dd6_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4108	f52a8823fc92aeb456f50df7da8c9dd6_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4108 wrote to memory of 2736	4108	f52a8823fc92aeb456f50df7da8c9dd6_JaffaCakes118.exe	82
PID 4108 wrote to memory of 2736	4108	f52a8823fc92aeb456f50df7da8c9dd6_JaffaCakes118.exe	82
PID 4108 wrote to memory of 2736	4108	f52a8823fc92aeb456f50df7da8c9dd6_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\f52a8823fc92aeb456f50df7da8c9dd6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f52a8823fc92aeb456f50df7da8c9dd6_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4108
- C:\Users\Admin\AppData\Local\TMP2584.exe
  C:\Users\Admin\AppData\Local\TMP2584.exe pth:C:\Users\Admin\AppData\Local\Temp\f52a8823fc92aeb456f50df7da8c9dd6_JaffaCakes118.exe
  2⤵
  - Executes dropped EXE
  PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\TMP2584.exe

Filesize
10.9MB

MD5
7e6f3fe40408d1caa99ce4a725764686

SHA1
22d5307f2a686d71eb1a8f36437c8dd65e425f79

SHA256
60768a80ab229d40ca3a7f2854ae082492744da6e8df1ae1a31919fa05f4c65a

SHA512
4b2b1b8404ba0c8194c762c790572ae66115f9413e50bce6461a2e599ec628caa64cfbaddba2de2c4e019f36337e2974a9f29d9b4060f7f993f1d2acc2ffe4ea

Download Submit