Analysis

  • max time kernel
    141s
  • max time network
    132s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-07-2024 07:09

General

  • Target

    669aa8332f009d8b41d4e6589797aa11_JaffaCakes118.exe

  • Size

    143KB

  • MD5

    669aa8332f009d8b41d4e6589797aa11

  • SHA1

    28f311c2e0e9d2390d569a8ebef813821ee3ad24

  • SHA256

    0227f68e278770f25bbaa225bc376dc8f2d08534c3fef718264420dc8b488a7c

  • SHA512

    a4d8b505ba342a9a05361897773d558fa82257a34016dc5b893e279e34aa0deb1904d5944416de002df220ccd4db1c466e35cfe5cacd739205d92251b6c14e0e

  • SSDEEP

    3072:tDZftW3jSH3zhkeTfxHDrPzllDIUVPAi0zn9o/H6JHZry6u7:RZVQ61kcHh+7i0nJHPu

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

Processes

  • C:\Users\Admin\AppData\Local\Temp\669aa8332f009d8b41d4e6589797aa11_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\669aa8332f009d8b41d4e6589797aa11_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    PID:4420

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\msnetcfg.scr

    Filesize

    41KB

    MD5

    9712011cbc46b65da10fe93227f922a8

    SHA1

    cb76e6ca78a574eedd1daa7ff39d658f41c8d7b9

    SHA256

    4e9a5f535367e1fee33d2c131ab8d79544f1269b92b5e65d3bb3ce48e480ccf9

    SHA512

    828e0f38ecebcf59a6131ecaa602bd42cc085c109515762775d65e1cea3cc9684e5f8c491e22acf55e334f4de449d93122e303696867231d2c3120dbfd407ba4

  • memory/4420-0-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB

  • memory/4420-1-0x00000000021B0000-0x00000000021B2000-memory.dmp

    Filesize

    8KB

  • memory/4420-2-0x0000000002210000-0x0000000002211000-memory.dmp

    Filesize

    4KB

  • memory/4420-17-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB

  • memory/4420-19-0x00000000021B0000-0x00000000021B2000-memory.dmp

    Filesize

    8KB

  • memory/4420-20-0x0000000002210000-0x0000000002211000-memory.dmp

    Filesize

    4KB