e471dd53ffaca9329d2dde5aa800855ba3bd235a5deb33baacc0bc7437d4ca50

Analysis

max time kernel
148s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02-10-2024 01:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

083d1ba08caccec2d2b8b87a3e5c2b4d_JaffaCakes118.exe
Size

69KB
MD5

083d1ba08caccec2d2b8b87a3e5c2b4d
SHA1

c5082f02e5f3ecf8d1a36a679a4da23319e68b5b
SHA256

e471dd53ffaca9329d2dde5aa800855ba3bd235a5deb33baacc0bc7437d4ca50
SHA512

83ded2c16b92eb800fbd7cc86122493fbfd7d934695f0d4c12bd1acbb04b98d54b4b3d7d3442691542c598ff0ed826a98095a3b0828635dcba712b43c82f1fcc
SSDEEP

1536:7fqqYaQcLy1TobUnVXABpQaMqtIRQH0nXNosPuYgDhwSW/c:OapLlbcZwyauu0nesYDhrkc

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
1312	083d1ba08caccec2d2b8b87a3e5c2b4d_JaffaCakes118.exe
1312	083d1ba08caccec2d2b8b87a3e5c2b4d_JaffaCakes118.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\Internet Explorer\InfoMs.sys	083d1ba08caccec2d2b8b87a3e5c2b4d_JaffaCakes118.exe
File opened for modification	C:\Program Files\Internet Explorer\InfoMs.sys	083d1ba08caccec2d2b8b87a3e5c2b4d_JaffaCakes118.exe
File created	C:\Program Files\Internet Explorer\InfoMs.tdm	083d1ba08caccec2d2b8b87a3e5c2b4d_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	083d1ba08caccec2d2b8b87a3e5c2b4d_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1312	083d1ba08caccec2d2b8b87a3e5c2b4d_JaffaCakes118.exe
1312	083d1ba08caccec2d2b8b87a3e5c2b4d_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1312	083d1ba08caccec2d2b8b87a3e5c2b4d_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\083d1ba08caccec2d2b8b87a3e5c2b4d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\083d1ba08caccec2d2b8b87a3e5c2b4d_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Internet Explorer\InfoMs.tdm

Filesize
46KB

MD5
29eaf7901ebb4cd824f25c87f4eda51c

SHA1
61720fefe6a63d506688a1c889c2aa88938dd546

SHA256
ed071ba52887ee780dbff592ee255010ac8c6f1adf20a1147107308b421162bd

SHA512
be1f69007cb64fb6a0d98eaa6e9578a1eca2b083190c2dabf5075283be7774b3de5d285892673ea36d6c57636c230e0455741be069862f04cc172727fff53f93

Download Submit
memory/1312-6-0x0000000002290000-0x00000000022A1000-memory.dmp

Filesize
68KB

Download
memory/1312-9-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1312-10-0x0000000002290000-0x00000000022A1000-memory.dmp

Filesize
68KB

Download
memory/1312-34-0x0000000002290000-0x00000000022A1000-memory.dmp

Filesize
68KB

Download