736af15e4f08bf0e70a879bd3bd98b21deb0f4dfefd00f53de7fe3ea0c50814c

Analysis

max time kernel
95s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/09/2024, 05:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f54430d157c755169853f3c37ca8a1bd_JaffaCakes118.exe
Size

135KB
MD5

f54430d157c755169853f3c37ca8a1bd
SHA1

a99354595c164d75c4a988b12e2586b66b03c29d
SHA256

736af15e4f08bf0e70a879bd3bd98b21deb0f4dfefd00f53de7fe3ea0c50814c
SHA512

93b5db63ca0ba42fa7767389945cdc26ddad23994e79a2aa396fd62396a667e70fec172a7c2838f594cbb3d92c3e5113713daddd50b70b21ed5581258c6a3585
SSDEEP

3072:IxTqpdA3f6QNf2IPO4DpmWpAsfYbTOBoefYi6a9k20tA3Z/ccqcPs:q2pdqfv2IPOGfXf5ovWJUKPs

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\dextor32.exe	f54430d157c755169853f3c37ca8a1bd_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f54430d157c755169853f3c37ca8a1bd_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\f54430d157c755169853f3c37ca8a1bd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f54430d157c755169853f3c37ca8a1bd_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Temp\CKY3 - Bam Margera World Industries Alien Workshop Full Downloader.exe

Filesize
135KB

MD5
f54430d157c755169853f3c37ca8a1bd

SHA1
a99354595c164d75c4a988b12e2586b66b03c29d

SHA256
736af15e4f08bf0e70a879bd3bd98b21deb0f4dfefd00f53de7fe3ea0c50814c

SHA512
93b5db63ca0ba42fa7767389945cdc26ddad23994e79a2aa396fd62396a667e70fec172a7c2838f594cbb3d92c3e5113713daddd50b70b21ed5581258c6a3585

Download Submit
memory/1308-101-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download