0de950988ee08560c0c361b461c76ada6adf9af6ccc73fe7a5fae324f544126a

Analysis

max time kernel
94s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
27/09/2024, 06:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f9e40f8d13655194191740f02d728306_JaffaCakes118.exe
Size

876KB
MD5

f9e40f8d13655194191740f02d728306
SHA1

817d279a81be9f53ea92a6379cc0e76207aa2740
SHA256

0de950988ee08560c0c361b461c76ada6adf9af6ccc73fe7a5fae324f544126a
SHA512

7f32ef19f1189ca4b8da59e0ddd91329fa4a7b3e0255428ec8256a96dbd8aaede8c388952497505bc2b8b38087d040cebcf16ff8a78620e005e7264fe6c85229
SSDEEP

24576:4RmJkcoQricOIQxiZY1WNVQc22Hbzk7BgGcVt:9JZoQrbTFZY1WNVT227Y7Jat

Score

5^/10

discovery

Malware Config

Signatures

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/2488-0-0x0000000000400000-0x00000000004AF000-memory.dmp	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f9e40f8d13655194191740f02d728306_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	f9e40f8d13655194191740f02d728306_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	f9e40f8d13655194191740f02d728306_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\f9e40f8d13655194191740f02d728306_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f9e40f8d13655194191740f02d728306_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\t_16\ttm.png

Filesize
17KB

MD5
53dbabe0643c1717507402d7ed0f5f6c

SHA1
9243adddefad63267ce5ed5ce905e3edd98171be

SHA256
94a8c1918d49cafbfb4bb0c3b86737201cc792449fbd37925bea66dd84157a63

SHA512
14618558bd7838dc26b3b0063c2b7010005e5db2e873bfdd2edbb8b46dd9332ccebd133e858478c0f968e5860afe400c4635df73c5c701de68df833957863d08

Download Submit
memory/2488-0-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download