415ada1d5c34db12d726ebed2f95d6e91e411d14f4205bcd481fd3dd5fbc7bb9

Analysis

max time kernel
138s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15/10/2024, 04:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

45e7d8565a8f41742a32c7e36e793671_JaffaCakes118.exe
Size

98KB
MD5

45e7d8565a8f41742a32c7e36e793671
SHA1

7ac51895d010bc9ae20b2b0c40a5a860071c7913
SHA256

415ada1d5c34db12d726ebed2f95d6e91e411d14f4205bcd481fd3dd5fbc7bb9
SHA512

f2ec48e1415222312379459df02a95d91b1dcbb61ef010da4d14af44566cec1434d8982302e620f1b7f49c8f9d61ecdef244d261fb4b8d08947b7ae29c869677
SSDEEP

1536:b1ioW9RQMOFyjHklG2oU7BIx8D64U3IIwLVEhJGWbE4XW26gsn6:xiXDQMOF2HyRnCx8HuNg8XW26T6

Score

5^/10

discovery

Malware Config

Signatures

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\EtNDuISBB.dll	45e7d8565a8f41742a32c7e36e793671_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\EtNDuISBB.dll	45e7d8565a8f41742a32c7e36e793671_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	45e7d8565a8f41742a32c7e36e793671_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4040	45e7d8565a8f41742a32c7e36e793671_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\45e7d8565a8f41742a32c7e36e793671_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\45e7d8565a8f41742a32c7e36e793671_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4040-0-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/4040-1-0x00000000001C0000-0x00000000001C3000-memory.dmp

Filesize
12KB

Download
memory/4040-2-0x0000000000418000-0x0000000000419000-memory.dmp

Filesize
4KB

Download
memory/4040-4-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/4040-3-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/4040-5-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/4040-6-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/4040-11-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/4040-12-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/4040-13-0x00000000001C0000-0x00000000001C3000-memory.dmp

Filesize
12KB

Download