Analysis
-
max time kernel
149s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
01-08-2024 11:59
General
-
Target
806e12989ef4cd2697d14d030418d274_JaffaCakes118.exe
-
Size
1.1MB
-
MD5
806e12989ef4cd2697d14d030418d274
-
SHA1
34ed04c779ad13709eb204a96c4692364d0b1b19
-
SHA256
18ca68216d2301aa19c21531d27b550324fcf5481a31644cbb8a957bc3b05ba3
-
SHA512
e1f4bfea59636124224b7ed78cf1ddecc64a5679bb9671caaf53c06f06cfc1367ec2390452261afbbf4b684de15e363bea30c7334ddff6745fea05f74ed5d863
-
SSDEEP
12288:jt0nMKpavtSGLwEBaETahdjvzS1QgiY8AHl6HzDxKXdR:jaMK+tT0Eru/jG1QvYzEDxiR
Score
10/10
Malware Config
Extracted
Family
latentbot
C2
trustighul2839.zapto.org
Signatures
-
LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\806e12989ef4cd2697d14d030418d274_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\806e12989ef4cd2697d14d030418d274_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB