6071fbcdd5b88f0a13bfc00f7cdcb3d94036e188079d0fd34f34440a54f6069b

Analysis

max time kernel
94s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/09/2024, 06:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f56d4cf6c41d5358604f67b1afc0fc19_JaffaCakes118.exe
Size

2.5MB
MD5

f56d4cf6c41d5358604f67b1afc0fc19
SHA1

56116defd55c2f0748a48eebf632a05cbdb872c7
SHA256

6071fbcdd5b88f0a13bfc00f7cdcb3d94036e188079d0fd34f34440a54f6069b
SHA512

625512891d8b84e7fce158ee669aff402f211d698f7c2f1b8c2bc186b3132bf0929af20b2a67758bd66bd0ace70bf1f656e30c353e6dd226d7a75a6ea337e849
SSDEEP

49152:+mVkBaP8o+dm4Dls9WLrtfAVzAlWTB1LoMes5tRK8OwrwvL:+qkcPmdmtW/uVza6B1P5rK898vL

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
5064	f56d4cf6c41d5358604f67b1afc0fc19_JaffaCakes118.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f56d4cf6c41d5358604f67b1afc0fc19_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\f56d4cf6c41d5358604f67b1afc0fc19_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f56d4cf6c41d5358604f67b1afc0fc19_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\aiw240616296.DLL

Filesize
44KB

MD5
20bf232c3275106c1ff710666c8a3509

SHA1
9268d98b0b6f5526dd4e27fe95ed547587f72144

SHA256
8888c95571a60a4355fbee6401bd7f3d27e701d4376c1f7f083b8fc52c7d098a

SHA512
163c8cd3b6e503ec4d7dcc530427ae6be7bc8cfd8ad075da48d4dff468780bca5149611fc9036fb014618050a30fa227161361e9622e55a61ad30f775475022f

Download Submit