b971f5ccdad11f9938a448389a078e0ab836ad5334f2576cff29022848714e79

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2024, 04:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3deaf99a0c24ae95a910c92a6e60c1e5_JaffaCakes118.exe
Size

2.0MB
MD5

3deaf99a0c24ae95a910c92a6e60c1e5
SHA1

3dd4face7fc7ffa326ad33c3ddd2ecce35746380
SHA256

b971f5ccdad11f9938a448389a078e0ab836ad5334f2576cff29022848714e79
SHA512

7af5bfa0b14c9ef3db8ac940e3f3b49a5a2e64f4324f09949b83b53dceaa2f3b1cdcc64e2a39dd38acb206dc9d80c33c26c2ff1f2c564144fa3874d8feccda9e
SSDEEP

49152:R68/9B69hwCRkHRHb6+WHg6VTrh0Ik9uWDBNQW4N:RQ9iCw76+r63KTVNqW4N

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3deaf99a0c24ae95a910c92a6e60c1e5_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Internet Explorer\IESettingSync	3deaf99a0c24ae95a910c92a6e60c1e5_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	3deaf99a0c24ae95a910c92a6e60c1e5_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	3deaf99a0c24ae95a910c92a6e60c1e5_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	3deaf99a0c24ae95a910c92a6e60c1e5_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3372	3deaf99a0c24ae95a910c92a6e60c1e5_JaffaCakes118.exe
3372	3deaf99a0c24ae95a910c92a6e60c1e5_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\3deaf99a0c24ae95a910c92a6e60c1e5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3deaf99a0c24ae95a910c92a6e60c1e5_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\EMOTIONSOFT\PornoProtector\License.html

Filesize
15KB

MD5
7e3907a2f7bf2a7541a6578207ea83bf

SHA1
5ed3eac18edb2f1a733a3b5dfd5179114724cbdb

SHA256
804c95d57c49a16cd31420c51f10707ff5cb32f01b98930d237e6c5d15f56e08

SHA512
53d5e4aeb8577bde2e3588416c5b378c62af34938cb8735b749852ce2ff3c017174fa422613826bcaf8809bc7cf1ebc4feff2a0475578390462a304dce8dbd71

Download Submit