95d652e2c8c01f47a5658a145ff086a37333176ca587dbc148a67615a945698c

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29/09/2024, 07:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fe0b46c50f2d80f6567d31bdd008fc78_JaffaCakes118.exe
Size

511KB
MD5

fe0b46c50f2d80f6567d31bdd008fc78
SHA1

4afff0a7a4d45d2321402e6e967a97798b397c19
SHA256

95d652e2c8c01f47a5658a145ff086a37333176ca587dbc148a67615a945698c
SHA512

961ef7620a7a96254a0a1a4fe5c19ce0e57a25acdc104bbdecba63a2b00340c1925c8546c0e2241f900afe7de354b8d33cf31c42a964446da3ed31ae67860b9b
SSDEEP

12288:2raWpCxyNlpjEwhfyqSXSu9nt4jCkv1JBlUhBNV7auZ06:mhC4pjEwJ4lt4jz1JrU5BTZ06

Score

6^/10

discovery evasion trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	fe0b46c50f2d80f6567d31bdd008fc78_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fe0b46c50f2d80f6567d31bdd008fc78_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3040	fe0b46c50f2d80f6567d31bdd008fc78_JaffaCakes118.exe
3040	fe0b46c50f2d80f6567d31bdd008fc78_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\fe0b46c50f2d80f6567d31bdd008fc78_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fe0b46c50f2d80f6567d31bdd008fc78_JaffaCakes118.exe"
1⤵
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3040-0-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/3040-1-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/3040-2-0x0000000000680000-0x0000000000681000-memory.dmp

Filesize
4KB

Download
memory/3040-4-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download