Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
27-07-2024 00:22
Static task
static1
Behavioral task
behavioral1
Sample
765b26ff499c3b38234e584da0c300d0_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
765b26ff499c3b38234e584da0c300d0_JaffaCakes118.exe
-
Size
434KB
-
MD5
765b26ff499c3b38234e584da0c300d0
-
SHA1
cf98108e1c157466a938184ebe4b1e00eab1c8cf
-
SHA256
656a9c2d84cb23c55ce263a17908ea8a357edf3c796458912ce11227e75ecd00
-
SHA512
c6401a308c9a283478a20dab812acea9172e4dc8a719cb32f1e264e864617bb5887bd6b00e36bc85e4acd30b93abc88ad89de1ad309fa7582d18d82ebd48a6f5
-
SSDEEP
12288:rXPcLcbGfVylwG/ZDCK/ScBXo8TsyMkKMY8m7WOK95OTTsx/SA/WegYfdNbrqnut:rXh6XcBXo8TsL8Y8m4OTTySA/DrfdNbz
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1104 GetX64BTIT.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 27 api.ipify.org 28 api.ipify.org -
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 765b26ff499c3b38234e584da0c300d0_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3456 765b26ff499c3b38234e584da0c300d0_JaffaCakes118.exe 3456 765b26ff499c3b38234e584da0c300d0_JaffaCakes118.exe 3456 765b26ff499c3b38234e584da0c300d0_JaffaCakes118.exe 3456 765b26ff499c3b38234e584da0c300d0_JaffaCakes118.exe 3456 765b26ff499c3b38234e584da0c300d0_JaffaCakes118.exe 3456 765b26ff499c3b38234e584da0c300d0_JaffaCakes118.exe 3456 765b26ff499c3b38234e584da0c300d0_JaffaCakes118.exe 3456 765b26ff499c3b38234e584da0c300d0_JaffaCakes118.exe 3456 765b26ff499c3b38234e584da0c300d0_JaffaCakes118.exe 3456 765b26ff499c3b38234e584da0c300d0_JaffaCakes118.exe 3456 765b26ff499c3b38234e584da0c300d0_JaffaCakes118.exe 3456 765b26ff499c3b38234e584da0c300d0_JaffaCakes118.exe 3456 765b26ff499c3b38234e584da0c300d0_JaffaCakes118.exe 3456 765b26ff499c3b38234e584da0c300d0_JaffaCakes118.exe 3456 765b26ff499c3b38234e584da0c300d0_JaffaCakes118.exe 3456 765b26ff499c3b38234e584da0c300d0_JaffaCakes118.exe 3456 765b26ff499c3b38234e584da0c300d0_JaffaCakes118.exe 3456 765b26ff499c3b38234e584da0c300d0_JaffaCakes118.exe 3456 765b26ff499c3b38234e584da0c300d0_JaffaCakes118.exe 3456 765b26ff499c3b38234e584da0c300d0_JaffaCakes118.exe 3456 765b26ff499c3b38234e584da0c300d0_JaffaCakes118.exe 3456 765b26ff499c3b38234e584da0c300d0_JaffaCakes118.exe 3456 765b26ff499c3b38234e584da0c300d0_JaffaCakes118.exe 3456 765b26ff499c3b38234e584da0c300d0_JaffaCakes118.exe 3456 765b26ff499c3b38234e584da0c300d0_JaffaCakes118.exe 3456 765b26ff499c3b38234e584da0c300d0_JaffaCakes118.exe 3456 765b26ff499c3b38234e584da0c300d0_JaffaCakes118.exe 3456 765b26ff499c3b38234e584da0c300d0_JaffaCakes118.exe 3456 765b26ff499c3b38234e584da0c300d0_JaffaCakes118.exe 3456 765b26ff499c3b38234e584da0c300d0_JaffaCakes118.exe 3456 765b26ff499c3b38234e584da0c300d0_JaffaCakes118.exe 3456 765b26ff499c3b38234e584da0c300d0_JaffaCakes118.exe 3456 765b26ff499c3b38234e584da0c300d0_JaffaCakes118.exe 3456 765b26ff499c3b38234e584da0c300d0_JaffaCakes118.exe 3456 765b26ff499c3b38234e584da0c300d0_JaffaCakes118.exe 3456 765b26ff499c3b38234e584da0c300d0_JaffaCakes118.exe 3456 765b26ff499c3b38234e584da0c300d0_JaffaCakes118.exe 3456 765b26ff499c3b38234e584da0c300d0_JaffaCakes118.exe 3456 765b26ff499c3b38234e584da0c300d0_JaffaCakes118.exe 3456 765b26ff499c3b38234e584da0c300d0_JaffaCakes118.exe 3456 765b26ff499c3b38234e584da0c300d0_JaffaCakes118.exe 3456 765b26ff499c3b38234e584da0c300d0_JaffaCakes118.exe 3456 765b26ff499c3b38234e584da0c300d0_JaffaCakes118.exe 3456 765b26ff499c3b38234e584da0c300d0_JaffaCakes118.exe 3456 765b26ff499c3b38234e584da0c300d0_JaffaCakes118.exe 3456 765b26ff499c3b38234e584da0c300d0_JaffaCakes118.exe 3456 765b26ff499c3b38234e584da0c300d0_JaffaCakes118.exe 3456 765b26ff499c3b38234e584da0c300d0_JaffaCakes118.exe 3456 765b26ff499c3b38234e584da0c300d0_JaffaCakes118.exe 3456 765b26ff499c3b38234e584da0c300d0_JaffaCakes118.exe 3456 765b26ff499c3b38234e584da0c300d0_JaffaCakes118.exe 3456 765b26ff499c3b38234e584da0c300d0_JaffaCakes118.exe 3456 765b26ff499c3b38234e584da0c300d0_JaffaCakes118.exe 3456 765b26ff499c3b38234e584da0c300d0_JaffaCakes118.exe 3456 765b26ff499c3b38234e584da0c300d0_JaffaCakes118.exe 3456 765b26ff499c3b38234e584da0c300d0_JaffaCakes118.exe 3456 765b26ff499c3b38234e584da0c300d0_JaffaCakes118.exe 3456 765b26ff499c3b38234e584da0c300d0_JaffaCakes118.exe 3456 765b26ff499c3b38234e584da0c300d0_JaffaCakes118.exe 3456 765b26ff499c3b38234e584da0c300d0_JaffaCakes118.exe 3456 765b26ff499c3b38234e584da0c300d0_JaffaCakes118.exe 3456 765b26ff499c3b38234e584da0c300d0_JaffaCakes118.exe 3456 765b26ff499c3b38234e584da0c300d0_JaffaCakes118.exe 3456 765b26ff499c3b38234e584da0c300d0_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3456 765b26ff499c3b38234e584da0c300d0_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3456 wrote to memory of 1104 3456 765b26ff499c3b38234e584da0c300d0_JaffaCakes118.exe 87 PID 3456 wrote to memory of 1104 3456 765b26ff499c3b38234e584da0c300d0_JaffaCakes118.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\765b26ff499c3b38234e584da0c300d0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\765b26ff499c3b38234e584da0c300d0_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"2⤵
- Executes dropped EXE
PID:1104
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5b4cd27f2b37665f51eb9fe685ec1d373
SHA17f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA25691f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e
-
Filesize
28B
MD59016e76ec499127538902d8337f95728
SHA1f245d9370a23b51ed297be0eb802f7a0f1552e17
SHA2568602b1538265f708264a31412f9c800a097b226f47f6f0eaf5442a53a639c493
SHA512c9a62a03f877abe52aabed463b937b5a66ae5e209e6ca051fa6ce3483215584a1c43b98892a411e4ed50a5dd511c43a014e860814ea7af3af06a5ee68450f8e0