d74f823ce86b38132baa4d3ada71f2122f8287d0e187d50be6dd9475fd06041d

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/10/2024, 09:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1737695487ded8546481a5b538d0c33e_JaffaCakes118.exe
Size

303KB
MD5

1737695487ded8546481a5b538d0c33e
SHA1

e5bf1932d48a2efc74c942f0d10c903f27c21fbd
SHA256

d74f823ce86b38132baa4d3ada71f2122f8287d0e187d50be6dd9475fd06041d
SHA512

cf8c0c15af47aeaa102dfd3dc8953d99242f14775fa81fb4153c34802290678b2dc81f7cf23c0ce34e974b8941fcc02c41a1c74a3d076c745474d81ac68a6080
SSDEEP

6144:7rwj6Y0JQBkQRl7174NpNUM+UHs+BAg68c7s9M6TYguMtxkv2nSaNT:7rM63yRl1uqM+gs+BAD8fO6TYIIvYSaB

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
1340	1737695487ded8546481a5b538d0c33e_JaffaCakes118.exe
1340	1737695487ded8546481a5b538d0c33e_JaffaCakes118.exe
1340	1737695487ded8546481a5b538d0c33e_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1737695487ded8546481a5b538d0c33e_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\1737695487ded8546481a5b538d0c33e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1737695487ded8546481a5b538d0c33e_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\TsuD01328D8.dll

Filesize
269KB

MD5
af7ce801c8471c5cd19b366333c153c4

SHA1
4267749d020a362edbd25434ad65f98b073581f1

SHA256
cf7e00ba429bc9f27ccfacc49ae367054f40ada6cede9f513cc29a24e88bf49e

SHA512
88655bd940e9b540c4df551fe68135793eceed03f94389b0654637a18b252bf4d3ef73b0c49548b5fa6ba2cf6d9aff79335c4ebcc0b668e008bcc62c40d2a73c

Download Submit
C:\Users\Admin\AppData\Local\Temp\{04E08D15-7D50-4485-A66E-3572DF03AFE3}\Custom.dll

Filesize
60KB

MD5
fd32fa94d7d1fd130cf66b4f3f8d5e62

SHA1
0c84fc22238d84e7fcce6434583f830186b2b78a

SHA256
1ce7acf7912f9442ba8ccd5606147bc50ed3d810666e74a99f6401b2d9edaa5b

SHA512
8d37c841f0e04d4ddd92bd2b4849e1da4eca2bcdc77a82942eb5810c6dc6494de587e62f2e5ec65d1bacc7c7c9e15994000d3044322806f9b6ffe9bb6deb2bc0

Download Submit
C:\Users\Admin\AppData\Local\Temp\{04E08D15-7D50-4485-A66E-3572DF03AFE3}\_Setup.dll

Filesize
158KB

MD5
7d8a0eab1a44ad176b392ae45d9583a2

SHA1
21dd756c9bfe59270bce4eb105510cfdb32d25f4

SHA256
efea18641a36326859bd5f27da5998a3ad8842528b772cd4e1069309d1beb757

SHA512
a11f6dc7ea30f5b563fe0794f61ef155e97ed49faa4d937c404be47d937219cde4fa0c48eb2d99a1c839c01314eba54be7ed2dcc2a7da17738cf95400592a6d5

Download Submit