b3ff86d039f2498d15d30399d6e5266292d425b87287f2bbae2edd8baaf40678

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04-10-2024 02:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

116ab7b1ce79e227f904e86055929f50_JaffaCakes118.exe
Size

402KB
MD5

116ab7b1ce79e227f904e86055929f50
SHA1

c4f3cd115b303576418b896a94ac8957b0e8f063
SHA256

b3ff86d039f2498d15d30399d6e5266292d425b87287f2bbae2edd8baaf40678
SHA512

d0e816d30d8c269490c2bd5583d2f0e9c9bd5108b4ef91b5b34628d122a06f867c75e8dc1bc2fca4399588ccc27dc4d0f79ef62ed9473d24b1c3a42d4a3ee11a
SSDEEP

6144:NTt0zVZDY2zmr6aL0+aXMUqNU2iMmORtpuSEomltTyhTCEpti:NpqVFzTaaXM162iOPpu+ETOi

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2892	116ab7b1ce79e227f904e86055929f50_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	116ab7b1ce79e227f904e86055929f50_JaffaCakes118.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{69BC6A12-B146-E900-4E29-F11EDC07FEFB}	116ab7b1ce79e227f904e86055929f50_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{69BC6A12-B146-E900-4E29-F11EDC07FEFB} \data = "9f2f59c24ba2434daacb3026a639ccab"	116ab7b1ce79e227f904e86055929f50_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\116ab7b1ce79e227f904e86055929f50_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\116ab7b1ce79e227f904e86055929f50_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\OICBD83.tmp

Filesize
806KB

MD5
232aa835b2c28a96e3d4ae48a9aeffbb

SHA1
3e97355c47f672070810768d1a6cad1792fadfab

SHA256
3f3df42d67f102e385450dada3c9ea332dcf0722adf3f4d22356df9baccb3ad1

SHA512
9a35242c8596eb2144c2c23f2e5fceba18c38e292da2cc70b01bd9a2f8d028adea91355cfce5b14f53ee2288767f09245b2101367c9e488b400e90e45dd94acb

Download Submit