Analysis
-
max time kernel
136s -
max time network
108s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
25-07-2024 13:46
Static task
static1
Behavioral task
behavioral1
Sample
6fd3b21fb0e6c0d290dc2f2ccf23d7ac_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
6fd3b21fb0e6c0d290dc2f2ccf23d7ac_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
6fd3b21fb0e6c0d290dc2f2ccf23d7ac_JaffaCakes118.exe
-
Size
2.6MB
-
MD5
6fd3b21fb0e6c0d290dc2f2ccf23d7ac
-
SHA1
263c2645c79b2d864c653e31a1194da1c466a7ed
-
SHA256
495586be095e5970063aa69e4d7f141f7da5eef676a18168bff72e4ce4b4c98d
-
SHA512
bdb38136420b66228516986404593e283fc9730f6eb26744f0549923a2284fa54d00e3f905984d0043885f8f74778b1c56c2acfa3a7a22965d437a42f76f2138
-
SSDEEP
49152:tYFMSTro/KSdCyU1eV5hWLkVvluBOBLA0xn0HQQpeY9UFKP:tYFPryTkyUMVyLkVvw8LAsnMQQpFmFKP
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
pid Process 2492 6fd3b21fb0e6c0d290dc2f2ccf23d7ac_JaffaCakes118.exe 2492 6fd3b21fb0e6c0d290dc2f2ccf23d7ac_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6fd3b21fb0e6c0d290dc2f2ccf23d7ac_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 2492 6fd3b21fb0e6c0d290dc2f2ccf23d7ac_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2492 6fd3b21fb0e6c0d290dc2f2ccf23d7ac_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2492 6fd3b21fb0e6c0d290dc2f2ccf23d7ac_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6fd3b21fb0e6c0d290dc2f2ccf23d7ac_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6fd3b21fb0e6c0d290dc2f2ccf23d7ac_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2492
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5cc7c7df636a134a4ec2c693d96e03021
SHA14eaf0eb50330d2b30f273f665306314ac295a182
SHA256a3cef89cda4ab554915e292dbad8169ac30d9f5239e8d9fdd08d57e7c73db30e
SHA512fbfc5b8dfe4160f1a3ef0da72ed6758cd010654de48f984c0c5ea07e8d9e406f1203bbf3492a3a81817277905106e1dedf622a9bad4687a6e4f380e705de986b
-
Filesize
2KB
MD5fd0467cf47a5802cb2d101fa2069b8a9
SHA1273631ef0b420a2531350667a1a581ec1acfbfc2
SHA256c4da8976f42e5bf5929cbbbfd13e4cf8eee16b6e2e87e0675cbd1f3b7318af6e
SHA512aee90f16f0b2dfe5c45962b6a2bc151fb99c001b0aff2f76e77120c41121f039d825faa8419aeeb349727bbec2ac9601a3bf10159060a85746a86e7a4565c9fa