5e7dbec03f3b5c7d139bb2f7f82d7d560efb2205cad419c17a49107dee1da362

Analysis

max time kernel
136s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
02-11-2024 06:28

Target

84dec5d4fdfedc509ee0ee551256b8f7_JaffaCakes118.exe
Size

296KB
MD5

84dec5d4fdfedc509ee0ee551256b8f7
SHA1

10a557b312c082d283010e8490ac7b2040c3f1f9
SHA256

5e7dbec03f3b5c7d139bb2f7f82d7d560efb2205cad419c17a49107dee1da362
SHA512

d8508c68f60a6eb0bbfa78a9eae79b7fcd4055cedf4ab635283ad3b095558194fb4e6653378439861f702f014c5018738af679fc16ad1df11f0faa6f7585ec22
SSDEEP

6144:SrkI6Y0JQBkQRl7174NpNUM+UHs+1bL28uDrexqtreJA3/fkqnZr8uyaNPl7JCw:SrkI63yRl1uqM+gs+1+tPexUuA3/fBZb

Score

7^/10

discovery

Loads dropped DLL 3 IoCs

Processes:

84dec5d4fdfedc509ee0ee551256b8f7_JaffaCakes118.exe

pid	process
1864	84dec5d4fdfedc509ee0ee551256b8f7_JaffaCakes118.exe
1864	84dec5d4fdfedc509ee0ee551256b8f7_JaffaCakes118.exe
1864	84dec5d4fdfedc509ee0ee551256b8f7_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

84dec5d4fdfedc509ee0ee551256b8f7_JaffaCakes118.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84dec5d4fdfedc509ee0ee551256b8f7_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	84dec5d4fdfedc509ee0ee551256b8f7_JaffaCakes118.exe

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\Tsu8BF4561D.dll

Filesize
269KB

MD5
af7ce801c8471c5cd19b366333c153c4

SHA1
4267749d020a362edbd25434ad65f98b073581f1

SHA256
cf7e00ba429bc9f27ccfacc49ae367054f40ada6cede9f513cc29a24e88bf49e

SHA512
88655bd940e9b540c4df551fe68135793eceed03f94389b0654637a18b252bf4d3ef73b0c49548b5fa6ba2cf6d9aff79335c4ebcc0b668e008bcc62c40d2a73c

Download Submit
C:\Users\Admin\AppData\Local\Temp\{F132B377-6097-466F-A484-28B52AD19181}\Custom.dll

Filesize
62KB

MD5
3e15e552c1ae8a955bcf6ede52cec47d

SHA1
e0a7d81eb177c6ad0cd4e314d914414ec7d11dbe

SHA256
d210f4e66e5a8d0ba80dd4f76142976eedbe8c93272cd306ad980686542c0e14

SHA512
7cbe709a7f598d206b606d30cd784f828467880bea343930428d07d40ed5e7f4dd76d4e898c71643ec3079c4cf328f7ee9f0a224ca8e5dce8e87ea20f18865b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\{F132B377-6097-466F-A484-28B52AD19181}\_Setup.dll

Filesize
162KB

MD5
bf2742e4f3af1a4c812cb6092de3f5ab

SHA1
a8a681d539d228943d8a58a126d15e735d641fcf

SHA256
e078631151b1811ead30a4d1202bd65c14fd90935df253f1bde1d25522c21a93

SHA512
61082c8f047f7a5355dd66ab3d398c53603a4e4817d8f6927675f2c0380b4555befc295f82b3389291ca07f858a74166bb123054904c77cfc950c68704787238

Download Submit