Analysis

  • max time kernel
    148s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/07/2024, 16:11

General

  • Target

    68461041081f02c9bffe51d35d8db27b_JaffaCakes118.exe

  • Size

    439KB

  • MD5

    68461041081f02c9bffe51d35d8db27b

  • SHA1

    e1c3abc49646aeebcaa32524b95e06fb49531b6c

  • SHA256

    4545cb58c8b68a9686b79da3b5f15c35aa0344e1e49c0e1a146b8dd5a1f3678a

  • SHA512

    692cea60306726d69e0b541acb50f02f986f97da816b9939bb11928c93458ba0f6c096317b6b7180e7123101c6418eedbdbcc721e21c01d4574b96873e5d9cac

  • SSDEEP

    12288:iwBmJ6IETo3CYeU5ERNGqSOmzLA659KWv04h:i0m6VuQAqGASVh

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Modifies registry class 3 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\68461041081f02c9bffe51d35d8db27b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\68461041081f02c9bffe51d35d8db27b_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1880

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1880-0-0x0000000000400000-0x00000000004E3000-memory.dmp

    Filesize

    908KB

  • memory/1880-1-0x00000000022A0000-0x00000000022D0000-memory.dmp

    Filesize

    192KB

  • memory/1880-9-0x0000000002420000-0x0000000002421000-memory.dmp

    Filesize

    4KB

  • memory/1880-27-0x0000000002640000-0x0000000002641000-memory.dmp

    Filesize

    4KB

  • memory/1880-41-0x0000000002880000-0x0000000002881000-memory.dmp

    Filesize

    4KB

  • memory/1880-40-0x0000000002870000-0x0000000002871000-memory.dmp

    Filesize

    4KB

  • memory/1880-39-0x0000000002850000-0x0000000002851000-memory.dmp

    Filesize

    4KB

  • memory/1880-16-0x00000000024B0000-0x00000000024B1000-memory.dmp

    Filesize

    4KB

  • memory/1880-38-0x0000000002840000-0x0000000002841000-memory.dmp

    Filesize

    4KB

  • memory/1880-37-0x0000000002700000-0x0000000002701000-memory.dmp

    Filesize

    4KB

  • memory/1880-36-0x00000000026E0000-0x00000000026E1000-memory.dmp

    Filesize

    4KB

  • memory/1880-35-0x00000000026C0000-0x00000000026C1000-memory.dmp

    Filesize

    4KB

  • memory/1880-42-0x0000000002860000-0x0000000002861000-memory.dmp

    Filesize

    4KB

  • memory/1880-34-0x0000000002690000-0x0000000002691000-memory.dmp

    Filesize

    4KB

  • memory/1880-43-0x00000000028B0000-0x00000000028B1000-memory.dmp

    Filesize

    4KB

  • memory/1880-44-0x00000000028A0000-0x00000000028A1000-memory.dmp

    Filesize

    4KB

  • memory/1880-33-0x00000000026F0000-0x00000000026F1000-memory.dmp

    Filesize

    4KB

  • memory/1880-32-0x00000000026D0000-0x00000000026D1000-memory.dmp

    Filesize

    4KB

  • memory/1880-31-0x00000000026B0000-0x00000000026B1000-memory.dmp

    Filesize

    4KB

  • memory/1880-30-0x0000000002680000-0x0000000002681000-memory.dmp

    Filesize

    4KB

  • memory/1880-29-0x0000000002660000-0x0000000002661000-memory.dmp

    Filesize

    4KB

  • memory/1880-28-0x0000000002670000-0x0000000002671000-memory.dmp

    Filesize

    4KB

  • memory/1880-26-0x0000000002650000-0x0000000002651000-memory.dmp

    Filesize

    4KB

  • memory/1880-25-0x0000000002520000-0x0000000002521000-memory.dmp

    Filesize

    4KB

  • memory/1880-24-0x0000000002530000-0x0000000002531000-memory.dmp

    Filesize

    4KB

  • memory/1880-23-0x0000000002500000-0x0000000002501000-memory.dmp

    Filesize

    4KB

  • memory/1880-22-0x0000000002510000-0x0000000002511000-memory.dmp

    Filesize

    4KB

  • memory/1880-21-0x00000000024E0000-0x00000000024E1000-memory.dmp

    Filesize

    4KB

  • memory/1880-20-0x00000000024F0000-0x00000000024F1000-memory.dmp

    Filesize

    4KB

  • memory/1880-19-0x00000000024C0000-0x00000000024C1000-memory.dmp

    Filesize

    4KB

  • memory/1880-18-0x00000000024D0000-0x00000000024D1000-memory.dmp

    Filesize

    4KB

  • memory/1880-17-0x00000000024A0000-0x00000000024A1000-memory.dmp

    Filesize

    4KB

  • memory/1880-15-0x0000000002480000-0x0000000002481000-memory.dmp

    Filesize

    4KB

  • memory/1880-14-0x0000000002490000-0x0000000002491000-memory.dmp

    Filesize

    4KB

  • memory/1880-13-0x0000000002460000-0x0000000002461000-memory.dmp

    Filesize

    4KB

  • memory/1880-12-0x0000000002470000-0x0000000002471000-memory.dmp

    Filesize

    4KB

  • memory/1880-11-0x0000000002440000-0x0000000002441000-memory.dmp

    Filesize

    4KB

  • memory/1880-8-0x0000000002430000-0x0000000002431000-memory.dmp

    Filesize

    4KB

  • memory/1880-7-0x00000000023E0000-0x00000000023E1000-memory.dmp

    Filesize

    4KB

  • memory/1880-10-0x0000000002450000-0x0000000002451000-memory.dmp

    Filesize

    4KB

  • memory/1880-6-0x0000000002270000-0x0000000002271000-memory.dmp

    Filesize

    4KB

  • memory/1880-5-0x0000000000650000-0x0000000000651000-memory.dmp

    Filesize

    4KB

  • memory/1880-4-0x00000000023D0000-0x00000000023D1000-memory.dmp

    Filesize

    4KB

  • memory/1880-3-0x0000000002280000-0x0000000002281000-memory.dmp

    Filesize

    4KB

  • memory/1880-2-0x0000000002290000-0x0000000002293000-memory.dmp

    Filesize

    12KB

  • memory/1880-48-0x0000000002C60000-0x0000000002C61000-memory.dmp

    Filesize

    4KB

  • memory/1880-46-0x0000000002C40000-0x0000000002C41000-memory.dmp

    Filesize

    4KB

  • memory/1880-47-0x0000000002C70000-0x0000000002C71000-memory.dmp

    Filesize

    4KB

  • memory/1880-45-0x0000000002C50000-0x0000000002C51000-memory.dmp

    Filesize

    4KB

  • memory/1880-49-0x0000000000400000-0x00000000004E3000-memory.dmp

    Filesize

    908KB

  • memory/1880-51-0x00000000030E0000-0x00000000030E1000-memory.dmp

    Filesize

    4KB

  • memory/1880-50-0x00000000030F0000-0x00000000030F1000-memory.dmp

    Filesize

    4KB

  • memory/1880-52-0x00000000043F0000-0x00000000043F1000-memory.dmp

    Filesize

    4KB

  • memory/1880-53-0x00000000043E0000-0x00000000043E1000-memory.dmp

    Filesize

    4KB

  • memory/1880-57-0x00000000048D0000-0x00000000048D1000-memory.dmp

    Filesize

    4KB

  • memory/1880-56-0x00000000048E0000-0x00000000048E1000-memory.dmp

    Filesize

    4KB

  • memory/1880-55-0x0000000004790000-0x0000000004791000-memory.dmp

    Filesize

    4KB

  • memory/1880-54-0x00000000047A0000-0x00000000047A1000-memory.dmp

    Filesize

    4KB

  • memory/1880-58-0x00000000022A0000-0x00000000022D0000-memory.dmp

    Filesize

    192KB

  • memory/1880-66-0x0000000004750000-0x0000000004751000-memory.dmp

    Filesize

    4KB

  • memory/1880-65-0x0000000004760000-0x0000000004761000-memory.dmp

    Filesize

    4KB

  • memory/1880-64-0x0000000004730000-0x0000000004731000-memory.dmp

    Filesize

    4KB

  • memory/1880-63-0x0000000004740000-0x0000000004741000-memory.dmp

    Filesize

    4KB

  • memory/1880-62-0x0000000004710000-0x0000000004711000-memory.dmp

    Filesize

    4KB

  • memory/1880-61-0x0000000004720000-0x0000000004721000-memory.dmp

    Filesize

    4KB

  • memory/1880-60-0x00000000046F0000-0x00000000046F1000-memory.dmp

    Filesize

    4KB

  • memory/1880-59-0x0000000004700000-0x0000000004701000-memory.dmp

    Filesize

    4KB

  • memory/1880-74-0x00000000053C0000-0x00000000053C1000-memory.dmp

    Filesize

    4KB

  • memory/1880-73-0x00000000054E0000-0x00000000054E1000-memory.dmp

    Filesize

    4KB

  • memory/1880-72-0x00000000053A0000-0x00000000053A1000-memory.dmp

    Filesize

    4KB

  • memory/1880-71-0x00000000053B0000-0x00000000053B1000-memory.dmp

    Filesize

    4KB

  • memory/1880-70-0x0000000005380000-0x0000000005381000-memory.dmp

    Filesize

    4KB

  • memory/1880-69-0x0000000005390000-0x0000000005391000-memory.dmp

    Filesize

    4KB

  • memory/1880-68-0x0000000005330000-0x0000000005331000-memory.dmp

    Filesize

    4KB

  • memory/1880-67-0x0000000005370000-0x0000000005371000-memory.dmp

    Filesize

    4KB

  • memory/1880-76-0x00000000054F0000-0x00000000054F1000-memory.dmp

    Filesize

    4KB

  • memory/1880-75-0x0000000005500000-0x0000000005501000-memory.dmp

    Filesize

    4KB

  • memory/1880-99-0x0000000002860000-0x0000000002861000-memory.dmp

    Filesize

    4KB

  • memory/1880-100-0x0000000000400000-0x00000000004E3000-memory.dmp

    Filesize

    908KB