Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15-04-2024 20:17
Static task
static1
Behavioral task
behavioral1
Sample
f1d62702461221144af7063fbb04c4ce_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f1d62702461221144af7063fbb04c4ce_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f1d62702461221144af7063fbb04c4ce_JaffaCakes118.exe
-
Size
43KB
-
MD5
f1d62702461221144af7063fbb04c4ce
-
SHA1
5b8f6460c30576936f8de1a6edd9413aacd5f434
-
SHA256
9db438af9564c894d811ee21f6509059d9dc4b2738d5e33f16325066d852648b
-
SHA512
659dc5d635b8919f8e9545a0b2e423e8c3dc26840fb275ca793b09883759ec49172d8d5017ef6c63df2a5dcc9bd28918c1b93cea4b6bbb6915a6c4dce97c93d2
-
SSDEEP
768:oQfkWCGFczFfqUNCFbrzF/vytLDi7k4qkcr:o/GFczZHNactLDQE
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Control Panel\International\Geo\Nation f1d62702461221144af7063fbb04c4ce_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of UnmapMainImage 1 IoCs
pid Process 2948 f1d62702461221144af7063fbb04c4ce_JaffaCakes118.exe