d3cb5d726b806930ce867d005555581f189a78f26faad9f1b2dbecf1b7d632ae

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/10/2024, 06:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2c41c5a3fad7834af2ff6a5db8bb04c3_JaffaCakes118.exe
Size

75KB
MD5

2c41c5a3fad7834af2ff6a5db8bb04c3
SHA1

b6c5989f0d4b9e8cd165aeb92d6e6a9dff2ef826
SHA256

d3cb5d726b806930ce867d005555581f189a78f26faad9f1b2dbecf1b7d632ae
SHA512

e8f9861ca8631d1d1198926cf9f075a0bbfa976e4a97670771ff0cd272a68e17790acb97aaf1259bbb1f2ac430ec124e0c036156e51c9a92aaa065d108fba5d4
SSDEEP

1536:QJJI5Vorz//oTc6AO+NzmRt1cVOXdbzPtxfLWDP:QJSVoev/1cVWlFEb

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	2c41c5a3fad7834af2ff6a5db8bb04c3_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2c41c5a3fad7834af2ff6a5db8bb04c3_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
220	2c41c5a3fad7834af2ff6a5db8bb04c3_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\2c41c5a3fad7834af2ff6a5db8bb04c3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2c41c5a3fad7834af2ff6a5db8bb04c3_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Le!Tj0 CoDeR.exe

Filesize
54KB

MD5
ef4c072f07790b772c9cacdc76c6cd03

SHA1
58ba96bb79b5e0cdb73ba00054f5cd28dc8f44c7

SHA256
c3cc95fe628de19db058f1f74a0c39dea4b39ebde2dd7782448945cba8b6c444

SHA512
1350a5db305c78ecff90dc79f80f2f116c34d257ff987d4e2b37d9ca33a3e12f2fcfa1dcaf74088916aea18eaaf9b338f9efe982bb140f0c5f4433c6779b926c

Download Submit