Analysis

  • max time kernel
    140s
  • max time network
    132s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-07-2024 21:49

General

  • Target

    75dd362a5408303a78cab2ff5315208d_JaffaCakes118.exe

  • Size

    80KB

  • MD5

    75dd362a5408303a78cab2ff5315208d

  • SHA1

    cf4d7ac3fd8eb9786b277384155adb7ba6ead5b5

  • SHA256

    4ea694a7b4398e5dd1b27e885842a97fdbc529b59c236c6fdbfdb8b5d8c3bc84

  • SHA512

    692bd8f1c4829a0c2b9beedc2bff6b8e23418a1b41bc6510c1441e1a38d2de7d4de37a5e4c052038e23bffe561dcc523f7b6bd249fb59ba74d709317430a1b73

  • SSDEEP

    768:416kvw5lJzSRfB9m8YU7JI0Go/yu1V716+yCuwB0o3QN:66d14mGco/hV7BLIN

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\75dd362a5408303a78cab2ff5315208d_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\75dd362a5408303a78cab2ff5315208d_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    PID:5112
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x320 0x2c8
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2176

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\bassmod.dll

    Filesize

    9KB

    MD5

    780d14604d49e3c634200c523def8351

    SHA1

    e208ef6f421d2260070a9222f1f918f1de0a8eeb

    SHA256

    844eb66a10b848d3a71a8c63c35f0a01550a46d2ff8503e2ca8947978b03b4d2

    SHA512

    a49c030f11da8f0cdc4205c86bec00653ec2f8899983cad9d7195fd23255439291aaec5a7e128e1a103efd93b8566e86f15af89eba4efebf9debce14a7a5564b

  • memory/5112-0-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB