d19d9b6cedd25060ff43c67aa1cf5119aa211238d12aea0a44497bbb3365cbb2

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/10/2024, 09:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2ec9507006f1c433f0b8018686b57e25_JaffaCakes118.exe
Size

75KB
MD5

2ec9507006f1c433f0b8018686b57e25
SHA1

1b7cea890dad634302fa592a006aaf7e131f3644
SHA256

d19d9b6cedd25060ff43c67aa1cf5119aa211238d12aea0a44497bbb3365cbb2
SHA512

90a2f2f2a4394f40ad13d123b2ddad8ee04e7af8bfd01557a2466f296609a47ab778257354e43677fdcd0b52266d47335c103aafae026ad6abb58227f53e1fbc
SSDEEP

1536:F2DxbD3Ww+3E92Ay4GBcddhJGqlqq6TaYqN2jGXwc8qoxyTwxJY:oDxu3kRyBgh6q8HqbXwc8qb8x

Score

8^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	2ec9507006f1c433f0b8018686b57e25_JaffaCakes118.exe

Loads dropped DLL 1 IoCs

pid	Process
3224	2ec9507006f1c433f0b8018686b57e25_JaffaCakes118.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rdpclicw.dll	2ec9507006f1c433f0b8018686b57e25_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\sendmsac.exe	2ec9507006f1c433f0b8018686b57e25_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\httpdsdm.dll	2ec9507006f1c433f0b8018686b57e25_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\dx8vndde.dat	2ec9507006f1c433f0b8018686b57e25_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2ec9507006f1c433f0b8018686b57e25_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3224	2ec9507006f1c433f0b8018686b57e25_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\2ec9507006f1c433f0b8018686b57e25_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2ec9507006f1c433f0b8018686b57e25_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\httpdsdm.dll

Filesize
20KB

MD5
5fcd2163b7dc5be972857112ee1f5013

SHA1
f375dff0d7bd5da6575a3fae9c7828574024c36b

SHA256
9d4cd337e6a7b6007961bb2d2e5ea3c30cc62c2a76fd046dbeac12484f17038f

SHA512
7a185cf981e7c6a73d63c6a939cc62b65472c73e1e437f20e43c93ddf2a907dcd88c7698f421fd12fd31abae1c015748ac3209a8451cdd5ce1438121b9443ad7

Download Submit
memory/3224-0-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/3224-8-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download