dfc37ab4427d7aa2b1b82b268f31d8c3155edcb271baf22aa5f162e7dd35e7ca

Analysis

max time kernel
92s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
27/09/2024, 14:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fa89490fdddc10d85d5fbaab9e7a6ebc_JaffaCakes118.exe
Size

134KB
MD5

fa89490fdddc10d85d5fbaab9e7a6ebc
SHA1

bdae60ff9248b27588d894f922b77fc36333500f
SHA256

dfc37ab4427d7aa2b1b82b268f31d8c3155edcb271baf22aa5f162e7dd35e7ca
SHA512

03ee7453d4baff6a3de04e810c2d9af34c04d8fc79a542479c62cd1d6eaf74a87e311795b0fb33c8a89b84ff2e0ee3a62ed6569afab2c3306857cd1c9da424ad
SSDEEP

3072:IxTqpdA3f6QNf2IPO4DpmWpAsfYbTOBoefYi6a9k20tA3Z/ccqcPJqi:q2pdqfv2IPOGfXf5ovWJUKPJqi

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\dextor32.exe	fa89490fdddc10d85d5fbaab9e7a6ebc_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fa89490fdddc10d85d5fbaab9e7a6ebc_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\fa89490fdddc10d85d5fbaab9e7a6ebc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fa89490fdddc10d85d5fbaab9e7a6ebc_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Temp\CKY3 - Bam Margera World Industries Alien Workshop Full Downloader.exe

Filesize
134KB

MD5
fa89490fdddc10d85d5fbaab9e7a6ebc

SHA1
bdae60ff9248b27588d894f922b77fc36333500f

SHA256
dfc37ab4427d7aa2b1b82b268f31d8c3155edcb271baf22aa5f162e7dd35e7ca

SHA512
03ee7453d4baff6a3de04e810c2d9af34c04d8fc79a542479c62cd1d6eaf74a87e311795b0fb33c8a89b84ff2e0ee3a62ed6569afab2c3306857cd1c9da424ad

Download Submit
memory/3940-101-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download