da223f3006cbb4c32396f7356d605ede817715c04ec0a574547e8fe6757f6744

Analysis

max time kernel
31s
max time network
40s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2024, 05:24

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

12032953a1f5f33066a60ab9a1cd0bb5_JaffaCakes118.exe
Size

61KB
MD5

12032953a1f5f33066a60ab9a1cd0bb5
SHA1

59a05476456af9eda82b2760f6346a45278fcd40
SHA256

da223f3006cbb4c32396f7356d605ede817715c04ec0a574547e8fe6757f6744
SHA512

3da9c97c7cb083ca24241cddc7e9b47b8f0beb59bab927d68f691ae514a5a7b06fdf658ec73172c421e2c5e8c830b059ee54b2332dd4032ddcd184926821a964
SSDEEP

1536:idcKzLcVmLc1X+Wpnb/W+5p6yZhlHqnImvTDZS66:UcKzLvc5dd/X5pVXlHUUH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
3048	12032953a1f5f33066a60ab9a1cd0bb5_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\48b92.imi	12032953a1f5f33066a60ab9a1cd0bb5_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\xlkhfq.fsl	12032953a1f5f33066a60ab9a1cd0bb5_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	12032953a1f5f33066a60ab9a1cd0bb5_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\12032953a1f5f33066a60ab9a1cd0bb5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\12032953a1f5f33066a60ab9a1cd0bb5_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\xlkhfq.fsl

Filesize
94KB

MD5
28b969d8a46b9611da783d36e2e88241

SHA1
6d44c6a9a78acfcb28c5129e8c70c326e89a5b63

SHA256
ae7c431366faa1cb6874ec5c62a79fedc87cce559f2d638f05d93578dcb46c0a

SHA512
31594e43f75ff40354034164adb36ecb8b7b84cf5173ea81c38b41e3623aa3f815540c3981ca134b42fbae3f28717dbc322e003d47f8638f4c9c5dd21a9ad464

Download Submit