74ca3379c985d2769f69a95670cb2d689543abe474a8014a1cad0e36b3ded620

Analysis

max time kernel
125s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
30/09/2024, 16:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

023c17ee8b561e47892ff15fc157213a_JaffaCakes118.exe
Size

293KB
MD5

023c17ee8b561e47892ff15fc157213a
SHA1

3685772dc6fc49de328e069dd975cd7ebb5fcfa5
SHA256

74ca3379c985d2769f69a95670cb2d689543abe474a8014a1cad0e36b3ded620
SHA512

2020a82cfe29a23a666eda5fd3aeb1807d7387228a426112de59c34aec8bd522a49a24ca3fc643344a8d0f0a2df8133ee3f449451a2dbde245d697121c7987c3
SSDEEP

6144:brk29uEo2S1YnQmCX492DkwNP3qpYFruKBCkW1vN8d5kGZUB1mGmafKgsJkwgBgD:brkOu6/eIo4e1ivEKnmGmCBsJkC

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
2352	023c17ee8b561e47892ff15fc157213a_JaffaCakes118.exe
2352	023c17ee8b561e47892ff15fc157213a_JaffaCakes118.exe
2352	023c17ee8b561e47892ff15fc157213a_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	023c17ee8b561e47892ff15fc157213a_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\023c17ee8b561e47892ff15fc157213a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\023c17ee8b561e47892ff15fc157213a_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2352

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1508,i,3861745594156495651,17595114179815238301,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:8
1⤵
PID:4644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\TsuEB36B5E2.dll

Filesize
269KB

MD5
af7ce801c8471c5cd19b366333c153c4

SHA1
4267749d020a362edbd25434ad65f98b073581f1

SHA256
cf7e00ba429bc9f27ccfacc49ae367054f40ada6cede9f513cc29a24e88bf49e

SHA512
88655bd940e9b540c4df551fe68135793eceed03f94389b0654637a18b252bf4d3ef73b0c49548b5fa6ba2cf6d9aff79335c4ebcc0b668e008bcc62c40d2a73c

Download Submit
C:\Users\Admin\AppData\Local\Temp\{432C0B18-E077-4091-A27A-A85598CF29EE}\Custom.dll

Filesize
63KB

MD5
3fa769ed1d2b9091f3efbc57fb68f549

SHA1
789f143223f269d7e890f454601af87b21ef6426

SHA256
70530c068b47268d47d0712b6f77d2d90665d548ff691f7994691c69dda54f48

SHA512
2725a892a2d12b7cc7327d5263831efbb21909a7ec1e775fb3c26c73e77475f295e7156469bf336d695926cfb48c8520aff1c6efddfb6cb3cdf2a80f4bd314e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\{432C0B18-E077-4091-A27A-A85598CF29EE}\_Setup.dll

Filesize
155KB

MD5
e1c84ed695017f793f7602037b18bdaa

SHA1
db62a3a035253dd5dc62b85023e09e882e305ab8

SHA256
307a76b1f73259acf5e792a3f0c4dee34004017d1f1c5e259f3acc157d4d1ec7

SHA512
065cb57398ca0914312801f3c600df22752661bc07988c2910598d2733c08dcc7b4a5852b2937ce1e08285f9cc3548aeff894648d867bb3e5c347aa634fe137e

Download Submit