Analysis

  • max time kernel
    91s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/07/2024, 21:14

General

  • Target

    3667ee204fb67397626c6d5f0170a4e7_JaffaCakes118.exe

  • Size

    1.1MB

  • MD5

    3667ee204fb67397626c6d5f0170a4e7

  • SHA1

    88332b4ff0b9981336c552d5e8fff0d06c60bd0f

  • SHA256

    e6e24e635c5ef22107fe97bda7411aa653cda078a2b65c66c0c1dd797cfffd87

  • SHA512

    0a3023f5cd61e13dbab45cae308bc58b63fb13a85e028d82023067d3dc2f1708a3f5b8e9273b4648372fb12397f1ddbd834eb136fc2af27d8485b1017bea0261

  • SSDEEP

    12288:4bJWn12NHfvGpPAQj+bkzUkaju1dNyK3UodRujmmKTGPMyjARQq+ZgLeFv6q:40n12NHGpPf+SJ7U4ujmBGPMIA

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

Processes

  • C:\Users\Admin\AppData\Local\Temp\3667ee204fb67397626c6d5f0170a4e7_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\3667ee204fb67397626c6d5f0170a4e7_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    PID:3460

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/3460-0-0x00007FFAD7C75000-0x00007FFAD7C76000-memory.dmp

          Filesize

          4KB

        • memory/3460-1-0x000000001BF60000-0x000000001C006000-memory.dmp

          Filesize

          664KB

        • memory/3460-2-0x00007FFAD79C0000-0x00007FFAD8361000-memory.dmp

          Filesize

          9.6MB

        • memory/3460-3-0x000000001C4E0000-0x000000001C9AE000-memory.dmp

          Filesize

          4.8MB

        • memory/3460-4-0x000000001CAC0000-0x000000001CB5C000-memory.dmp

          Filesize

          624KB

        • memory/3460-5-0x00007FFAD79C0000-0x00007FFAD8361000-memory.dmp

          Filesize

          9.6MB

        • memory/3460-6-0x0000000001A60000-0x0000000001A68000-memory.dmp

          Filesize

          32KB

        • memory/3460-7-0x000000001CC20000-0x000000001CC6C000-memory.dmp

          Filesize

          304KB

        • memory/3460-8-0x00007FFAD79C0000-0x00007FFAD8361000-memory.dmp

          Filesize

          9.6MB

        • memory/3460-10-0x00007FFAD79C0000-0x00007FFAD8361000-memory.dmp

          Filesize

          9.6MB