58840dde646d92b594b575a909bc1781901c5a70e324409f00430b53f3788b9e

Analysis

max time kernel
93s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25-09-2024 08:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f5a716c620cc45fb566407b514983797_JaffaCakes118.exe
Size

1.3MB
MD5

f5a716c620cc45fb566407b514983797
SHA1

36f9cf0deb303f34728db803c138b0f8cbff0e48
SHA256

58840dde646d92b594b575a909bc1781901c5a70e324409f00430b53f3788b9e
SHA512

7c68632bac784d630f897cb2c165e1d8eca4eb0f6e78f4cf103bfe782aafe2f6372b8aab42a2d1a59ce7f2839388f62429e951d03eee01d68db1680422c98471
SSDEEP

24576:yhTN3+pS4flp6fwAsAuq+JuF5qyptrrXHyFNGXR29QOSRC:yhTN6flpqwAEq+oXrHrLSDGh29QOSRC

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 5 IoCs

pid	Process
1464	f5a716c620cc45fb566407b514983797_JaffaCakes118.exe
1464	f5a716c620cc45fb566407b514983797_JaffaCakes118.exe
1464	f5a716c620cc45fb566407b514983797_JaffaCakes118.exe
1464	f5a716c620cc45fb566407b514983797_JaffaCakes118.exe
1464	f5a716c620cc45fb566407b514983797_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f5a716c620cc45fb566407b514983797_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 20 IoCs

pid	Process
1464	f5a716c620cc45fb566407b514983797_JaffaCakes118.exe
1464	f5a716c620cc45fb566407b514983797_JaffaCakes118.exe
1464	f5a716c620cc45fb566407b514983797_JaffaCakes118.exe
1464	f5a716c620cc45fb566407b514983797_JaffaCakes118.exe
1464	f5a716c620cc45fb566407b514983797_JaffaCakes118.exe
1464	f5a716c620cc45fb566407b514983797_JaffaCakes118.exe
1464	f5a716c620cc45fb566407b514983797_JaffaCakes118.exe
1464	f5a716c620cc45fb566407b514983797_JaffaCakes118.exe
1464	f5a716c620cc45fb566407b514983797_JaffaCakes118.exe
1464	f5a716c620cc45fb566407b514983797_JaffaCakes118.exe
1464	f5a716c620cc45fb566407b514983797_JaffaCakes118.exe
1464	f5a716c620cc45fb566407b514983797_JaffaCakes118.exe
1464	f5a716c620cc45fb566407b514983797_JaffaCakes118.exe
1464	f5a716c620cc45fb566407b514983797_JaffaCakes118.exe
1464	f5a716c620cc45fb566407b514983797_JaffaCakes118.exe
1464	f5a716c620cc45fb566407b514983797_JaffaCakes118.exe
1464	f5a716c620cc45fb566407b514983797_JaffaCakes118.exe
1464	f5a716c620cc45fb566407b514983797_JaffaCakes118.exe
1464	f5a716c620cc45fb566407b514983797_JaffaCakes118.exe
1464	f5a716c620cc45fb566407b514983797_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\f5a716c620cc45fb566407b514983797_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f5a716c620cc45fb566407b514983797_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\E_N4\HtmlView.fne

Filesize
224KB

MD5
5de3e6de5001ba45853c1824babe0774

SHA1
ce238d98ad066e53810e5872168bc84fc4f325cf

SHA256
5aa45b6024eae73a509041d0e532afef7a4a7fb5fb7e5efce29ff04313a6977e

SHA512
3b9945f6671c47cad49ab7e43ee24e430e3ce1b4d761604246c69aea9f4b8449a3133e8a7c8cf9f851e99525e7deedac414381a86f4d95faa80a471b7cb209db

Download Submit
C:\Users\Admin\AppData\Local\Temp\E_N4\iext.fnr

Filesize
216KB

MD5
f91cfe6df71fbbbe56ddf70247ab9b49

SHA1
6d6e25569bca49c19f2a4b07675194a1bf055eb4

SHA256
7169863abd2e9a59ae706235224222754c44eea12a4304f6ac426ac4a89688a9

SHA512
841a0632b0bca43d590f72602a0161e04c77e1e881d5bd6d294edab4f9c5577bb8e46f15dd6a0c831e5774fa53e449397146d57b8575ea04506a64f3842490aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\E_N4\krnln.fnr

Filesize
1.0MB

MD5
4b30dbe1a79b2b7572ff637cb3765ced

SHA1
b08eba0e9bdb62d426db8d2b3d451152a56f79a1

SHA256
4208bdf90e97398a452d459d89562bda361bc6e911a385c4e31481a776f69e6d

SHA512
40e99c4a9d160a734a1675d75209dd88c7389c95cf0d0b6101f7e9edb2f3ebfe85e7170f0f4bae8a2e9533048bd5ecd414797b02ef257aecd90431f0c29ccfce

Download Submit
memory/1464-0-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/1464-11-0x0000000002520000-0x0000000002564000-memory.dmp

Filesize
272KB

Download
memory/1464-18-0x00000000027B0000-0x00000000027EB000-memory.dmp

Filesize
236KB

Download
memory/1464-22-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download