1f7dd61817a8ddfb841f4ac0b013a5ef6fe4edff29ee4139794e6af2fd6c9677

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/09/2024, 05:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fdd965d846d163fcc3e9bcd5d4d416bc_JaffaCakes118.exe
Size

677KB
MD5

fdd965d846d163fcc3e9bcd5d4d416bc
SHA1

d32ea28cd65b82014a85ee554dbc3b7da334b9bc
SHA256

1f7dd61817a8ddfb841f4ac0b013a5ef6fe4edff29ee4139794e6af2fd6c9677
SHA512

4c3a59497f0e593ee484caa5e50ed45b3ad9ea048607e07f76ae24a26a3fd5ce46b3328f7aef3f691a20ab5b42e6d927ad40a387f4ca14f9ef0575c1037dca51
SSDEEP

12288:bRX8olwDJc/xxLXT3dBBTTvSShMlZqALBmLL+bEXZ2n00+v1BxWKk/BcEin/3IW4:bVlwDJc/xxLXTrMzBmLL+Us2I/j

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\web\log.htm	fdd965d846d163fcc3e9bcd5d4d416bc_JaffaCakes118.exe
File created	\??\c:\windows\services.exe	fdd965d846d163fcc3e9bcd5d4d416bc_JaffaCakes118.exe
File opened for modification	\??\c:\windows\services.exe	fdd965d846d163fcc3e9bcd5d4d416bc_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdd965d846d163fcc3e9bcd5d4d416bc_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\fdd965d846d163fcc3e9bcd5d4d416bc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fdd965d846d163fcc3e9bcd5d4d416bc_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Web\log.htm

Filesize
1B

MD5
7215ee9c7d9dc229d2921a40e899ec5f

SHA1
b858cb282617fb0956d960215c8e84d1ccf909c6

SHA256
36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068

SHA512
f90ddd77e400dfe6a3fcf479b00b1ee29e7015c5bb8cd70f5f15b4886cc339275ff553fc8a053f8ddc7324f45168cffaf81f8c3ac93996f6536eef38e5e40768

Download Submit
memory/3420-682-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download