562154c58bd9545489d903723a016d280f543873046cf7b3b72579738187f9fd

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27/01/2025, 15:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
JaffaCakes118_412cd1d59b19d6f2a1342e22232eadc0.exe
Size 2.5MB
Sample250127-s8amtavrhv
SHA256 562154c58bd9545489d903723a016d280f543873046cf7b3b72579738187f9fd
MD5 412cd1d59b19d6f2a1342e22232eadc0
SHA1 3f4641caf900dd86444b378ddd0b47af917b20c1
SHA512 03e71f240efdc2d083950fcd7fd8cb409510add75e43f86352b4da203ae4a5bd7b65c15564a72f25f18b8e65706b7b2f55029b564ae7140038eac288e7978093
SSDEEP 49152:8n8LeN/AQf1+uRyp4HO0O7oAQYqZMHVxow8tdcTqHeGlCh4H0dS+A020qgAy1qdO:TqNIQf1+J4HO0jhUHJ8tdcTqHeGl/0dH
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
3636	JaffaCakes118_412cd1d59b19d6f2a1342e22232eadc0.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_412cd1d59b19d6f2a1342e22232eadc0.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_412cd1d59b19d6f2a1342e22232eadc0.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_412cd1d59b19d6f2a1342e22232eadc0.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nsu9D9A.tmp\InstallOptions.dll
Size 12KB
SHA256 4f871b4c8815758f7718ad68d688c6dc05cae205ddf3bcb00147a99746414435
MD5 695751df50c11f303b060d63eababe1d
SHA1 ffa5fa91750c3e63589fecae8aa90c232611c94d
SHA512 c9877e0d08c65b23717f3acf3be92ead79c6afde594bd4358694e128fb7149f4a1f33380fae0fb65411e5c68a9d91d2a353b4ef3da5169d3452441eb65880ce0
SSDEEP 192:ebtwKT+lyf+vQ/QnXN4dGIIvfe+ncp+hebyWLblA3xrh3Gr4:gtwKTOyZQX+dGNvfe+2+1WLbsxBG
MD5 SHA1 SHA512 SSDEEP

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsu9D9A.tmp\ioSpecial.ini
Size 613B
SHA256 db2cdf194e513bf71131a6b1e047d23d52817c750efc4176847510b9c940b0c0
MD5 48427fcbfb2d2cc3b817c0d75091025d
SHA1 37633106b2560fcb8267c4eed372d1b588c673c7
SHA512 9ff3a7f4b3045f7374a4df25731f2bc7237459ea0fedb82adcf87a69d5cb184f85e28183eb46296855e9fae320aba4cf6a1d7a528198a3a3e1a59be8f3f97d8a
MD5 SHA1 SHA512