Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
01-08-2024 20:53
General
-
Target
81c3060dbf0532fe61d17c9cf21c4ed0_JaffaCakes118.exe
-
Size
41KB
-
MD5
81c3060dbf0532fe61d17c9cf21c4ed0
-
SHA1
1523d39db19802968337314f3fd196149dfe60ed
-
SHA256
efc0b79948e3466138efbcdfea7c656634ae5b15dfbf722945ba75dfe04d28f7
-
SHA512
3982950cf434b1dbcc711cd79e3d73952c446b9c527b78c6f73c3ab946ba7a196cb16ee631562d1dd30169078cbd63e7b1668662df2a2f9b022c8ff24daa551d
-
SSDEEP
768:veXQduxC+AFM/j4iumPxxUofrK75AOS1kcWXZ9dya6/brhykncj/:vVW1/j0mTra5AOokcWXZ9dya6jrZo/
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Drops file in System32 directory 2 IoCs
-
Drops file in Windows directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\81c3060dbf0532fe61d17c9cf21c4ed0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\81c3060dbf0532fe61d17c9cf21c4ed0_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\wscsvc.exeC:\Windows\SysWOW64\wscsvc.exe -service1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
41KB
MD581c3060dbf0532fe61d17c9cf21c4ed0
SHA11523d39db19802968337314f3fd196149dfe60ed
SHA256efc0b79948e3466138efbcdfea7c656634ae5b15dfbf722945ba75dfe04d28f7
SHA5123982950cf434b1dbcc711cd79e3d73952c446b9c527b78c6f73c3ab946ba7a196cb16ee631562d1dd30169078cbd63e7b1668662df2a2f9b022c8ff24daa551d
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
108KB