2030360974bce988975e923ab6bfb10373fb8140986fbcbdc710746a9253206e

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2024, 20:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4404282c5c276c6362d486661e6f0d98_JaffaCakes118.exe
Size

294KB
MD5

4404282c5c276c6362d486661e6f0d98
SHA1

6d098cd61494c7a9e53122ceca6e0fd49e132023
SHA256

2030360974bce988975e923ab6bfb10373fb8140986fbcbdc710746a9253206e
SHA512

773a1af0ee92a2efcc8d10407dafb7a451f4252f26bf526efc0b07b638508453670f844516fe5aa477183b407d28fa01e421408b37a53ef52451a7f9d3ba65df
SSDEEP

6144:frkW6Y0JQBkQRl7174NpNUM+UHs+2Y+xk+ZYFJcC23ziLaZzYU3mk/E:frkW63yRl1uqM+gs+2dmJOxmLaKU2uE

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
4728	4404282c5c276c6362d486661e6f0d98_JaffaCakes118.exe
4728	4404282c5c276c6362d486661e6f0d98_JaffaCakes118.exe
4728	4404282c5c276c6362d486661e6f0d98_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4404282c5c276c6362d486661e6f0d98_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\4404282c5c276c6362d486661e6f0d98_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4404282c5c276c6362d486661e6f0d98_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Tsu8DA93936.dll

Filesize
269KB

MD5
af7ce801c8471c5cd19b366333c153c4

SHA1
4267749d020a362edbd25434ad65f98b073581f1

SHA256
cf7e00ba429bc9f27ccfacc49ae367054f40ada6cede9f513cc29a24e88bf49e

SHA512
88655bd940e9b540c4df551fe68135793eceed03f94389b0654637a18b252bf4d3ef73b0c49548b5fa6ba2cf6d9aff79335c4ebcc0b668e008bcc62c40d2a73c

Download Submit
C:\Users\Admin\AppData\Local\Temp\{90A84344-C01A-497D-AB96-88384B4B61B2}\Custom.dll

Filesize
63KB

MD5
765050baf3bf6b2a023f72535b23c16e

SHA1
4f56ffcfe4b534592c12f09aaffef8d6987df2e1

SHA256
cea23e696368312a2b144aacddccb86b905b9a7062ee83777bd398780a6fb600

SHA512
4e2e536f4bf5e096608fa957ca645a933c7c1907bbb2f7ab30e3997e6ad4854daccacde304b683816b95d9235bac1889ac0bc3aea21184e1b091e5acb7782682

Download Submit
C:\Users\Admin\AppData\Local\Temp\{90A84344-C01A-497D-AB96-88384B4B61B2}\_Setup.dll

Filesize
158KB

MD5
6f55c9eb1696125a6cfd995d3fd4ed99

SHA1
6fbbd96ad163c00fd742798a42373238cfcb82c1

SHA256
8524c3e39fc590db17a53e15274ea38ed9c059072b5da9ca5ea52b6cee5d9cba

SHA512
fb762addffefae2073cce381b999944a3851034c9d6f78cc162324a8bcfa801d49dd9a0a753645c7333fd227c1063abda1eceddf51efac069bcbd97f468dfec8

Download Submit