Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    10-07-2024 04:00

General

  • Target

    333949bc8507d05d55611e6f4c2d7b28_JaffaCakes118.exe

  • Size

    47KB

  • MD5

    333949bc8507d05d55611e6f4c2d7b28

  • SHA1

    77082b2749dbd4e218d9478110e9a20915825fe7

  • SHA256

    8641b7e27903d74b454a5bd155902f6921cb1ed1d36c9c321951a1def26f57b8

  • SHA512

    a37193738a7a281feb4f5f42f30d2154298bc918942213928ec9e97e249ea6687b14f3e873212ac7984e20de72df4d22b273624205643835baa104566e1d6c09

  • SSDEEP

    768:mfJTWvWPy6Jg5+VdUn8vDNkwcrWonRmSWW++sTII5FB1EH4dQ2Y:0ZeL6PdAUDywKRTWekfrB3PY

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of UnmapMainImage 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\333949bc8507d05d55611e6f4c2d7b28_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\333949bc8507d05d55611e6f4c2d7b28_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of UnmapMainImage
    PID:1952

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1952-2-0x0000000000400000-0x000000000040D000-memory.dmp

    Filesize

    52KB

  • memory/1952-1-0x0000000000400000-0x000000000040D000-memory.dmp

    Filesize

    52KB

  • memory/1952-0-0x00000000003A0000-0x00000000003AF000-memory.dmp

    Filesize

    60KB

  • memory/1952-43-0x0000000000400000-0x000000000040D000-memory.dmp

    Filesize

    52KB