e90f0cb9e30c68b6ef22556018d9e82d5614b855236d088065df80115c9e4ea4

Analysis

max time kernel
126s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15/10/2024, 05:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4620f6fc45c5c99fe81016ebc223dd4b_JaffaCakes118.exe
Size

143KB
MD5

4620f6fc45c5c99fe81016ebc223dd4b
SHA1

36640da2789e8bbd5064d85c033319014ef4f085
SHA256

e90f0cb9e30c68b6ef22556018d9e82d5614b855236d088065df80115c9e4ea4
SHA512

0f7498db8ea10aa4b9309e2b4c58967e5f1c56a6cc6cce214afb38ed1b349a5b58505879ee8d0378a4a1cf61e0d63063504441d6261d402e2c6e254e99c7f77e
SSDEEP

3072:FsD2ADkpFGkTXlDJA6ba2esDetNxVgbTGV9XY:FplzpTVDVa2en/V6Mp

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\"	4620f6fc45c5c99fe81016ebc223dd4b_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4620f6fc45c5c99fe81016ebc223dd4b_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\4620f6fc45c5c99fe81016ebc223dd4b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4620f6fc45c5c99fe81016ebc223dd4b_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
124eeb104cb8c5891e2236be03591480

SHA1
2de363eeb01bd140ae62e1d3eeadb840a09da2ff

SHA256
d356b14846246097e42e4fd0e5a17dcb2827cd754b17f3b14d4bd43129803f84

SHA512
0aa9aa2e7d4625919deca99efa23874a6a431b6f06ce4564240f67c1a10a9013cb1fcbf3fb83124e0c7aceb5b2c8a452eff376f9a8c7eb207abaf6fe7bb93575

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c39e56a57fc632b867d0e68e19588b29

SHA1
2760af970ce71e75220cbec8626b666e770ce2c6

SHA256
3c0dc301406f7bc53ea3fd6de4bd245706e9e22be7308d8b0cbb75bb2871151c

SHA512
aef5c8aa1c1415a91a9ffae347d1ba65cbc40d98ce5eee51a27e99da582ee5e54824a5fb3bbe41bb9ac5df80838508feb4b414eb8c309a96635fe2df36b5d5c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0I0VVMWQ\tasks[1].htm

Filesize
5B

MD5
fda44910deb1a460be4ac5d56d61d837

SHA1
f6d0c643351580307b2eaa6a7560e76965496bc7

SHA256
933b971c6388d594a23fa1559825db5bec8ade2db1240aa8fc9d0c684949e8c9

SHA512
57dda9aa7c29f960cd7948a4e4567844d3289fa729e9e388e7f4edcbdf16bf6a94536598b4f9ff8942849f1f96bd3c00bc24a75e748a36fbf2a145f63bf904c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8F84.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8FE6.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads