fb802cc4225718c9954635e6f2af6eca8e0e3ebc01fe052de7efdec61b2de7bd

Analysis

max time kernel
20s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
12/10/2024, 01:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

37dfcde6451936d000f3a4a26f6a2b5f_JaffaCakes118.exe
Size

1023KB
MD5

37dfcde6451936d000f3a4a26f6a2b5f
SHA1

b5062b670acccb6c391646aac7a641023264b840
SHA256

fb802cc4225718c9954635e6f2af6eca8e0e3ebc01fe052de7efdec61b2de7bd
SHA512

2f9e3321a0b0b01c22c42969cdc726f4702ee1750f7caa01f9bd59be3d93b61207edd1e45044e4b80d0766b76619ae1b2b3656e99f21cbcfe39801be4aea2a92
SSDEEP

24576:422BcVp5TriS6U4Z3hxCq/VwicuKVmraPmnvLoPRzhB95Lc/UFkQ:T2i5T+S6U4Z3hxCqq6GPOsZFBcUF9

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	37dfcde6451936d000f3a4a26f6a2b5f_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	37dfcde6451936d000f3a4a26f6a2b5f_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2308	37dfcde6451936d000f3a4a26f6a2b5f_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2308	37dfcde6451936d000f3a4a26f6a2b5f_JaffaCakes118.exe
2308	37dfcde6451936d000f3a4a26f6a2b5f_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\37dfcde6451936d000f3a4a26f6a2b5f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\37dfcde6451936d000f3a4a26f6a2b5f_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2308-0-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/2308-1-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download