Analysis

  • max time kernel
    149s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    27/07/2024, 10:01

General

  • Target

    77c549767f12af0fbcd6656fff7e332f_JaffaCakes118.exe

  • Size

    285KB

  • MD5

    77c549767f12af0fbcd6656fff7e332f

  • SHA1

    c0f86a4e6987fff6ae073a4431785770f769cbb5

  • SHA256

    4deced4fe7e7cb2bcc6b3d66f790b61ca35cb951785949f02a232671f6982a7e

  • SHA512

    9476dfedb82fd3ae66e10683155775110a35db69b455332283ffd81ae16849a6bb3b7d0318a9109fee43c4def79d13c6b753fe58dd2491a628c7986279353daa

  • SSDEEP

    6144:3tD9D0JeSERGL8BrkbSlGH4q9adhxGX4/rAdOiuJRsPk0mL:3tD9AkSERGL8BgbS0YrdhxDJRE9

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\77c549767f12af0fbcd6656fff7e332f_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\77c549767f12af0fbcd6656fff7e332f_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    PID:2352

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2352-0-0x00000000002D0000-0x00000000002D1000-memory.dmp

    Filesize

    4KB

  • memory/2352-3-0x0000000000400000-0x00000000004A7000-memory.dmp

    Filesize

    668KB

  • memory/2352-4-0x0000000000400000-0x00000000004A7000-memory.dmp

    Filesize

    668KB

  • memory/2352-5-0x00000000002D0000-0x00000000002D1000-memory.dmp

    Filesize

    4KB

  • memory/2352-6-0x0000000000400000-0x00000000004A7000-memory.dmp

    Filesize

    668KB

  • memory/2352-7-0x0000000000400000-0x00000000004A7000-memory.dmp

    Filesize

    668KB

  • memory/2352-8-0x0000000000400000-0x00000000004A7000-memory.dmp

    Filesize

    668KB

  • memory/2352-9-0x0000000000400000-0x00000000004A7000-memory.dmp

    Filesize

    668KB

  • memory/2352-10-0x0000000000400000-0x00000000004A7000-memory.dmp

    Filesize

    668KB

  • memory/2352-11-0x0000000000400000-0x00000000004A7000-memory.dmp

    Filesize

    668KB

  • memory/2352-12-0x0000000000400000-0x00000000004A7000-memory.dmp

    Filesize

    668KB

  • memory/2352-13-0x0000000000400000-0x00000000004A7000-memory.dmp

    Filesize

    668KB

  • memory/2352-14-0x0000000000400000-0x00000000004A7000-memory.dmp

    Filesize

    668KB

  • memory/2352-15-0x0000000000400000-0x00000000004A7000-memory.dmp

    Filesize

    668KB

  • memory/2352-16-0x0000000000400000-0x00000000004A7000-memory.dmp

    Filesize

    668KB

  • memory/2352-17-0x0000000000400000-0x00000000004A7000-memory.dmp

    Filesize

    668KB