78b1ad06a2d6ec5e58d197b25b4ae0150023d0be5532a2f9456e5703c6311781

Analysis

max time kernel
95s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
30/09/2024, 17:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

028d38cd44d1b74d40874ee4a2c67d70_JaffaCakes118.exe
Size

619KB
MD5

028d38cd44d1b74d40874ee4a2c67d70
SHA1

947072f748ed0fb025640969e9369eb4a2095d11
SHA256

78b1ad06a2d6ec5e58d197b25b4ae0150023d0be5532a2f9456e5703c6311781
SHA512

7dab40659db2882750d3b172c3dff91a277efebf3e98da735878b040697c821bd90e7e96e936ecbbbdb3c4f5b31f6f24f47e10d0c3bc117c1cfdc57b08b49700
SSDEEP

12288:wTY26CMvOSfcWmQuOB5G8QJRvuI801FtZHgxf/4CDf4:STQuEmJR2HQF2f/4CDw

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\ODBC\CloudUpdate.exe	028d38cd44d1b74d40874ee4a2c67d70_JaffaCakes118.exe
File created	C:\Program Files\Common Files\ODBC\imjputyc.dll	028d38cd44d1b74d40874ee4a2c67d70_JaffaCakes118.exe
File created	C:\Program Files\Common Files\ODBC\svchost.exe	028d38cd44d1b74d40874ee4a2c67d70_JaffaCakes118.exe
File created	C:\Program Files\Common Files\ODBC\0ALqOEc18eQCjOM.tmp	028d38cd44d1b74d40874ee4a2c67d70_JaffaCakes118.exe
File created	C:\Program Files\SYSLOG.TXT	028d38cd44d1b74d40874ee4a2c67d70_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	028d38cd44d1b74d40874ee4a2c67d70_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeRestorePrivilege	1612	028d38cd44d1b74d40874ee4a2c67d70_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\028d38cd44d1b74d40874ee4a2c67d70_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\028d38cd44d1b74d40874ee4a2c67d70_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads