Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
22-05-2024 02:01
General
-
Target
659e945726430a0c35b715005c1fcdf3_JaffaCakes118.exe
-
Size
30KB
-
MD5
659e945726430a0c35b715005c1fcdf3
-
SHA1
cfb060941680e1fec9995e0553929524b57d56ba
-
SHA256
07e6e10ec21395463c307b5edc5c5dc4d130b8655f599e2cd152b5084b2d4426
-
SHA512
496a871f75dbdf0429175224ba89ff0556f539fcd97ce596b13426802387363fcdae3efe57f25d058e85d6decfe513bd373d8263d94f1b52cd770e3b7247a91c
-
SSDEEP
768:mG6CPIBtx3TkIZt+2+B+gTgwLa8Z8FAGdekJVt8CIj7ng:n6CPIBtxTkQwLVyuGdeIt8CIj7g
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\659e945726430a0c35b715005c1fcdf3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\659e945726430a0c35b715005c1fcdf3_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5d9fcd8cf6fc038d1a0bd5c1a139cb1f1
SHA1b80bae90573414b96132082aa8123090f2bc7520
SHA256bd571cb1cb1160af22cef062f848ffa3221f32edc60275647cfc917a49216bab
SHA5124367f1ee87dba61c753174bc9813e8a8c1cbe594f4fb075d613e45334b4197494988e4891241bafde1f7e6c4a29d18565233ee74bf66f25bfea6696f6ed7a0f1
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
624KB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
40KB
-
Filesize
344KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
7.7MB