bde8ea378540d799e162ee151f74ceb7948621f92615bbcc16cd02776a1b2445

Analysis

max time kernel
139s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18/10/2024, 11:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5733f1e7d5be462a61d0d08d668b35b2_JaffaCakes118.exe
Size

778KB
MD5

5733f1e7d5be462a61d0d08d668b35b2
SHA1

0ff6970a9afc9b216ddbdfd45cda3c37b45f742c
SHA256

bde8ea378540d799e162ee151f74ceb7948621f92615bbcc16cd02776a1b2445
SHA512

1808eb461ccd36a246915c2bafb778887f4cf70d0beb66241c7f86abb710c856aeb0e4418f60a88378ad589e88453b46344ae9cdfc3f48166911fed164392b42
SSDEEP

12288:Wh7FdDl74IxvNkZAliJO1sDu70yV/R+AS1vCWU/RlI5bfcA2:WhRdDl7dVeAmBDkZFrWU/RIbfF2

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
880	5733f1e7d5be462a61d0d08d668b35b2_JaffaCakes118.exe
880	5733f1e7d5be462a61d0d08d668b35b2_JaffaCakes118.exe
880	5733f1e7d5be462a61d0d08d668b35b2_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5733f1e7d5be462a61d0d08d668b35b2_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
880	5733f1e7d5be462a61d0d08d668b35b2_JaffaCakes118.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
880	5733f1e7d5be462a61d0d08d668b35b2_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 16 IoCs

pid	Process
880	5733f1e7d5be462a61d0d08d668b35b2_JaffaCakes118.exe
880	5733f1e7d5be462a61d0d08d668b35b2_JaffaCakes118.exe
880	5733f1e7d5be462a61d0d08d668b35b2_JaffaCakes118.exe
880	5733f1e7d5be462a61d0d08d668b35b2_JaffaCakes118.exe
880	5733f1e7d5be462a61d0d08d668b35b2_JaffaCakes118.exe
880	5733f1e7d5be462a61d0d08d668b35b2_JaffaCakes118.exe
880	5733f1e7d5be462a61d0d08d668b35b2_JaffaCakes118.exe
880	5733f1e7d5be462a61d0d08d668b35b2_JaffaCakes118.exe
880	5733f1e7d5be462a61d0d08d668b35b2_JaffaCakes118.exe
880	5733f1e7d5be462a61d0d08d668b35b2_JaffaCakes118.exe
880	5733f1e7d5be462a61d0d08d668b35b2_JaffaCakes118.exe
880	5733f1e7d5be462a61d0d08d668b35b2_JaffaCakes118.exe
880	5733f1e7d5be462a61d0d08d668b35b2_JaffaCakes118.exe
880	5733f1e7d5be462a61d0d08d668b35b2_JaffaCakes118.exe
880	5733f1e7d5be462a61d0d08d668b35b2_JaffaCakes118.exe
880	5733f1e7d5be462a61d0d08d668b35b2_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\5733f1e7d5be462a61d0d08d668b35b2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5733f1e7d5be462a61d0d08d668b35b2_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\E_N4\krnln.fnr

Filesize
1.1MB

MD5
638e737b2293cf7b1f14c0b4fb1f3289

SHA1
f8e2223348433b992a8c42c4a7a9fb4b5c1158bc

SHA256
baad4798c3ab24dec8f0ac3cde48e2fee2e2dffa60d2b2497cd295cd6319fd5b

SHA512
4d714a0980238c49af10376ff26ec9e6415e7057925b32ec1c24780c3671047ac5b5670e46c1c6cf9f160519be8f37e1e57f05c30c6c4bda3b275b143aa0bf12

Download Submit
C:\Users\Admin\AppData\Local\Temp\E_N4\script.fne

Filesize
152KB

MD5
4c36a56c52e92543c1553b5f6fdc6c29

SHA1
367af6b36e4017269833da2afae1e235de2a5f81

SHA256
f431015f2f4d04f44e21ae582c9d416718df3b24768f69b91e299bd47aae5258

SHA512
ad59057be70fc4f4e7320e60ce72993330c668964630918d5fc85cd008abbeb73c4ecc55be9f8c27ff6403d3826db85e4adbc94cfb665f302eba2624037b01ba

Download Submit
memory/880-0-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/880-10-0x0000000002450000-0x0000000002479000-memory.dmp

Filesize
164KB

Download
memory/880-20-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download