Analysis

  • max time kernel
    132s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-07-2024 14:49

General

  • Target

    680220f8b9570717b2edc5659beba20f_JaffaCakes118.exe

  • Size

    635KB

  • MD5

    680220f8b9570717b2edc5659beba20f

  • SHA1

    c5ff9cd916d16b21aeca67c9e3725e8d95ba61c8

  • SHA256

    444e8f699b6816d8c7a12f6af5127891de44c1c52d894739e2911646d0482c8f

  • SHA512

    f1f3e8d3f913374dd5c0edc97d9dfe66b1b0ccbe6887005bdbffe83996e0dc68baa6634ed9432970e182525443c1a127061fce32617054e60edd4b28d7c7259e

  • SSDEEP

    12288:aIbPsXD/YIYkaJou7JYOoujbeWADdAq08rWrDUj8p6b:aesXD/YIYkaJogJYOBbeWADdAqfWrDUB

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\680220f8b9570717b2edc5659beba20f_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\680220f8b9570717b2edc5659beba20f_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2852

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\offconfig.temp

    Filesize

    590B

    MD5

    df6e469e0839b6f1f85c62e4b9670759

    SHA1

    2506ecd534e876c65a982f0ff53fad009eb007a2

    SHA256

    8e5379f6d69d52935d85158e114fe396b18e758a5cd2bd1118b72380e6172e68

    SHA512

    fb48d126a450d38a54a7a5d0e2ff944696c29df5321a30fe768c16273c27475302a55bb447bd80beefde1697fd0ae281d6c8ce154cb29fcc5dc564a9b5302b49