123640fcabe38c4e67caf8e6b25b780e2a0670ead0d163217d3f32e80d5ab62f

Analysis

max time kernel
15s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01/10/2024, 01:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03de24eb99d93ed2c4b26bf0ca1bae55_JaffaCakes118.exe
Size

2.0MB
MD5

03de24eb99d93ed2c4b26bf0ca1bae55
SHA1

46cd4bfe1c8302f719b3561934a7d62b71af5327
SHA256

123640fcabe38c4e67caf8e6b25b780e2a0670ead0d163217d3f32e80d5ab62f
SHA512

a8d7baad7e1266c4b9c51a387cc432f9a9f388924c0683795ba31393f54b7115480dd3a8d8125013a75ca456322264ddc13469dbba6a6a62a61ae551859056a1
SSDEEP

49152:MZKPngdrRDjdmM5mbQIlKTX88dHMBYFwNrBouf:MZKPngdBZD5YlgNaouf

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	03de24eb99d93ed2c4b26bf0ca1bae55_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
2252	03de24eb99d93ed2c4b26bf0ca1bae55_JaffaCakes118.exe
2252	03de24eb99d93ed2c4b26bf0ca1bae55_JaffaCakes118.exe
2252	03de24eb99d93ed2c4b26bf0ca1bae55_JaffaCakes118.exe
2252	03de24eb99d93ed2c4b26bf0ca1bae55_JaffaCakes118.exe
2252	03de24eb99d93ed2c4b26bf0ca1bae55_JaffaCakes118.exe
2252	03de24eb99d93ed2c4b26bf0ca1bae55_JaffaCakes118.exe

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
2252	03de24eb99d93ed2c4b26bf0ca1bae55_JaffaCakes118.exe
2252	03de24eb99d93ed2c4b26bf0ca1bae55_JaffaCakes118.exe
2252	03de24eb99d93ed2c4b26bf0ca1bae55_JaffaCakes118.exe
2252	03de24eb99d93ed2c4b26bf0ca1bae55_JaffaCakes118.exe
2252	03de24eb99d93ed2c4b26bf0ca1bae55_JaffaCakes118.exe
2252	03de24eb99d93ed2c4b26bf0ca1bae55_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\03de24eb99d93ed2c4b26bf0ca1bae55_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\03de24eb99d93ed2c4b26bf0ca1bae55_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2252

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x51c
1⤵
PID:2784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Operate.ini

Filesize
565B

MD5
158d6ab55dc116c170534361264e8df2

SHA1
331464c3c9a0bc2440c83c73b3293c0dbb3adba2

SHA256
d355ef93561644617b729055c3bd145b21685225ac424ef2135c0ec5cc0df18c

SHA512
5cdb95add319a1bd2c6e91bfc03b985dfa66f47f22fbd32d7c487467b7d88a0989685612a311e7df9cdccc4e5c3b2d3308fc00f235da98dbe8401993276917b4

Download Submit
memory/2252-0-0x0000000000400000-0x0000000000A83000-memory.dmp

Filesize
6.5MB

Download
memory/2252-1-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2252-2-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2252-25-0x00000000040D0000-0x00000000040D1000-memory.dmp

Filesize
4KB

Download
memory/2252-30-0x0000000000400000-0x0000000000A83000-memory.dmp

Filesize
6.5MB

Download
memory/2252-31-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2252-32-0x00000000040D0000-0x00000000040D1000-memory.dmp

Filesize
4KB

Download