bfe80987b5ec031b5d4cdf89a2b6f296e9387132b12d35be720558959c5dcaa7

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/10/2024, 06:44

Target

1694dfdee136a7cc87b3d1b80092bb38_JaffaCakes118.exe
Size

294KB
MD5

1694dfdee136a7cc87b3d1b80092bb38
SHA1

7177715cda51f3c59220c8e4c502b2f882c1c472
SHA256

bfe80987b5ec031b5d4cdf89a2b6f296e9387132b12d35be720558959c5dcaa7
SHA512

2f3084eda05d6b6ab60987ed7417e15e25cf2c2e59142c96078cee1a44d4af5c4fef1eb659329c311d7e41ccd9d1820a2cea48a962aad0e2f70072b531e8479c
SSDEEP

6144:AkGd1DZxlWelOlMVDrcuJSsT4/ZOrss40AJq5aGI+MZX0RoeVJEmdX6P:AkGd1XlHlOqVncoTM4ssSJY3I+fVekKP

Score

7^/10

discovery

Loads dropped DLL 3 IoCs

pid	Process
2716	1694dfdee136a7cc87b3d1b80092bb38_JaffaCakes118.exe
2716	1694dfdee136a7cc87b3d1b80092bb38_JaffaCakes118.exe
2716	1694dfdee136a7cc87b3d1b80092bb38_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1694dfdee136a7cc87b3d1b80092bb38_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2716	1694dfdee136a7cc87b3d1b80092bb38_JaffaCakes118.exe
2716	1694dfdee136a7cc87b3d1b80092bb38_JaffaCakes118.exe

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\TsuFF29D22A.dll

Filesize
267KB

MD5
0088a8b8a6bdeee89b3a7e17d01da6e4

SHA1
f0d46b59379c79c27ac5a38cb67740433f36614d

SHA256
429e4259ae65713991bf882507477768cd2adb14bca6f8191a4a31cefb3a7b24

SHA512
c8102dc9357db70ce0c2f7fc908bc32883576c007616dd5a297029edd115ffcdb756ef4c39d8c7cc274188ecc4d69d2be2470c34aaa4cc76d2da2e2003f1e81c

Download Submit
C:\Users\Admin\AppData\Local\Temp\{3BCC2746-01CC-7CA1-9E4A-49EEE02F05B0}\_Setup.dll

Filesize
205KB

MD5
95dea87b4295317b6aaf85ce56c4f57f

SHA1
34d54e4dd7cd1a18754e54d0bd83880e41d155cc

SHA256
6db25bce80d2b8916438d09595a3bf443b146b5b49b22eef2f2478a95ea716a2

SHA512
c46af29d20994676f078996febe8141abdf90e96fbac8bc609aade8a49d5bfe51b027ac0f3e952f8393cdc9a2bec7855b199e662506883b356837f7f5aa21c72

Download Submit
C:\Users\Admin\AppData\Local\Temp\{3BCC2746-01CC-7CA1-9E4A-49EEE02F05B0}\_Setupx.dll

Filesize
42KB

MD5
66e0d3cb3825b658880be576875795bc

SHA1
740982ce3b3e4bd08c1cbd5fc8cfeb982f1d4e05

SHA256
27b7921fbbd360bf77db65a50b2cd9a600e6baaaf77fd60eee74476d9fc6c7e0

SHA512
23873b2052f66d3b5961cfd5ca26d4d3f507cbd0317116e6b773d23defe47c164e1040fb56392f17cd2644528c64dfbfdeccc46e1965a650786414c8f8f74c7b

Download Submit