f33634cca497ee7c3ced4f838e2f082f005276e83a9c04276aa881765d39bfd0

Analysis

max time kernel
96s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
28-01-2025 01:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_45a3e9c11a7fd9583c8e789f3f02e965.exe
Size

204KB
MD5

45a3e9c11a7fd9583c8e789f3f02e965
SHA1

9e2eaec889819a2c2d05b5f6b8b00c7a70c8b07f
SHA256

f33634cca497ee7c3ced4f838e2f082f005276e83a9c04276aa881765d39bfd0
SHA512

83b02808aae9b979b231a91cb454aadefd6020f999fd32b2b6da10ba20d1098f37ac692e3bd53ef2b0b4209c895e3a2ca9b551c3ac9bc7ad09a6c92ded62c634
SSDEEP

3072:JgorgETGstqNo3IRcbCrNQyCsGZd0Q+6s1ADeZ6a/NsPivc8YTtjklHf8wk:6oEKGrFrNQjZd0Q01A06P8TYTtjklH03

Score

8^/10

discovery persistence

Malware Config

Signatures

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NetCreate1\Parameters\ServiceDll = "C:\\DoCumEnts And SetTinGs\\LocalSeRVice\\NetCreate.dll"	JaffaCakes118_45a3e9c11a7fd9583c8e789f3f02e965.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_45a3e9c11a7fd9583c8e789f3f02e965.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4512	JaffaCakes118_45a3e9c11a7fd9583c8e789f3f02e965.exe
4512	JaffaCakes118_45a3e9c11a7fd9583c8e789f3f02e965.exe
4512	JaffaCakes118_45a3e9c11a7fd9583c8e789f3f02e965.exe
4512	JaffaCakes118_45a3e9c11a7fd9583c8e789f3f02e965.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_45a3e9c11a7fd9583c8e789f3f02e965.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_45a3e9c11a7fd9583c8e789f3f02e965.exe"
1⤵
- Server Software Component: Terminal Services DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4512

C:\Windows\SysWOW64\SVCHOST.EXE
C:\Windows\SysWOW64\SVCHOST.EXE -K IMGSVC
1⤵
PID:3240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads