Analysis

  • max time kernel
    143s
  • max time network
    129s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-07-2024 01:29

General

  • Target

    69bf4174a854720c9d561f5f513cc50f_JaffaCakes118.exe

  • Size

    1.4MB

  • MD5

    69bf4174a854720c9d561f5f513cc50f

  • SHA1

    01b391a5c645fd3538d55cfaae25a1f5db064122

  • SHA256

    27284f31fd7cdbefc829d7ae48c4f859bca3bc2335640ec3a9a0f37fa0539dec

  • SHA512

    d701ba2f6fcb0f62223a428f33aa78d91f99d364a305d4213d6af6851550b5762faa3a4195e53dd5184a6aab3f3e4c05f4ca1e231a47e1514387850de52f46be

  • SSDEEP

    3072:tZrxJ703Hw9d8/npFiYT1ZtgCTt5x9rNzzhVTXeBTA/E1f79hgOYs4qv:t9UZyCTzJORA/EnGB/q

Score
10/10

Malware Config

Extracted

Credentials

  • Protocol:
    ftp
  • Host:
    31.170.164.93
  • Port:
    21
  • Username:
    u512078821
  • Password:
    594524

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\69bf4174a854720c9d561f5f513cc50f_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\69bf4174a854720c9d561f5f513cc50f_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:2212

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2212-0-0x0000000000400000-0x000000000047A000-memory.dmp

    Filesize

    488KB

  • memory/2212-1-0x0000000000400000-0x000000000047A000-memory.dmp

    Filesize

    488KB