1bf10d1f4259b8b4f151f769f59ffc536e6e728b0d2a032c11a58bed882f523b

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/09/2024, 06:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fe02860710acfcd991217f8f463b4f1f_JaffaCakes118.exe
Size

25KB
MD5

fe02860710acfcd991217f8f463b4f1f
SHA1

01a70a6265d861b5acce5b3aba4ff06d22993b2c
SHA256

1bf10d1f4259b8b4f151f769f59ffc536e6e728b0d2a032c11a58bed882f523b
SHA512

b63b84eaff1af1f08f066b585e7cc19e0765e49a3b1ab059c45714367672fc9968efec84abdde1206e30437a36c1f2ac720a347ae1c7420311408cf920b0232b
SSDEEP

384:ovYqgJdX4WxiYUIz7+dc4D3hZ3EcUtmUD/FW5Z/KvGjHuHgiXN21dMaKO+Q:uYqo4VnIzaxD3b3BUtdQ5Z/KvRRXGuQ

Score

5^/10

discovery

Malware Config

Signatures

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\c03f18df.dll	fe02860710acfcd991217f8f463b4f1f_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\c03f18df.dll	fe02860710acfcd991217f8f463b4f1f_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fe02860710acfcd991217f8f463b4f1f_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\fe02860710acfcd991217f8f463b4f1f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fe02860710acfcd991217f8f463b4f1f_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3168-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3168-3-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download