b5ed7177ac50ac808f5da4c602a1c59e72b6eefde65ec11f6a87cb507e62d911

Analysis

max time kernel
120s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01-10-2024 05:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0491f1c0f2458e43e73d108f2fc42d9f_JaffaCakes118.exe
Size

2.8MB
MD5

0491f1c0f2458e43e73d108f2fc42d9f
SHA1

6d0e62b9c2233b4e4c4626c516f0464c0c1a9191
SHA256

b5ed7177ac50ac808f5da4c602a1c59e72b6eefde65ec11f6a87cb507e62d911
SHA512

361398f37e93fbdcdf87121267f80586199a837886e6c13a16241e920d8128b01ec10e7392117d2299de43a7b66f8fbbcd921d2f7a520847f86717b884e0cf78
SSDEEP

49152:FkEePOyqTkZWL8oVpOqbTUeCDf3n0sXqIorCQJzxUkDH6jEOORSmCcuMiavQW8dO:CEePOyqTgWLPbHqf30UqvrCQx6jhpXaP

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
4208	0491f1c0f2458e43e73d108f2fc42d9f_JaffaCakes118.exe
4208	0491f1c0f2458e43e73d108f2fc42d9f_JaffaCakes118.exe
4208	0491f1c0f2458e43e73d108f2fc42d9f_JaffaCakes118.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\GLBSINST.%$D	0491f1c0f2458e43e73d108f2fc42d9f_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0491f1c0f2458e43e73d108f2fc42d9f_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\0491f1c0f2458e43e73d108f2fc42d9f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0491f1c0f2458e43e73d108f2fc42d9f_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\GLC7CB2.tmp

Filesize
161KB

MD5
8c97d8bb1470c6498e47b12c5a03ce39

SHA1
15d233b22f1c3d756dca29bcc0021e6fb0b8cdf7

SHA256
a87f19f9fee475d2b2e82acfb4589be6d816b613064cd06826e1d4c147beb50a

SHA512
7ad0b2b0319da52152c2595ee45045d0c06b157cdaaa56ad57dde9736be3e45fd7357949126f80d3e72b21510f9bf69d010d51b3967a7644662808beed067c3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\GLK7CE2.tmp

Filesize
33KB

MD5
517419cae37f6c78c80f9b7d0fbb8661

SHA1
a9e419f3d9ef589522556e0920c84fe37a548873

SHA256
bfe7e013cfb85e78b994d3ad34eca08286494a835cb85f1d7bced3df6fe93a11

SHA512
5046565443cf463b6fa4d2d5868879efc6a9db969bf05e3c80725b99bd091ce062cfe66c5551eb1cc5f00a38f2cfcda1f36fb4d60d9ff816c4ec3107b5a0df40

Download Submit