Analysis
-
max time kernel
149s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
11/08/2024, 03:12
General
-
Target
88c71b4476cc7b5f910a89e858373756_JaffaCakes118.exe
-
Size
21KB
-
MD5
88c71b4476cc7b5f910a89e858373756
-
SHA1
f71fd69ef71e81205f91fb58da5b8a5dd31ac5d9
-
SHA256
c8a657cd6b152b08ae360bba97995edd279e8dad273d9055f97ee91e16c302e6
-
SHA512
8556f508c40364321e1de9c8157d4373539dffddd44d0db30b7e33193627b67de7fa20e0b8f6152b12c6804a86128ecc7157374b40cf767b1f14cfce1c6ae310
-
SSDEEP
384:cLj2ZlDd72I7iL5j9hnoHdV7Ld0IDMurMJJH9ELjkd7cInIrk:6mqz5xhno9VF0IOHb73Irk
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 28 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\88c71b4476cc7b5f910a89e858373756_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\88c71b4476cc7b5f910a89e858373756_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
664KB
-
Filesize
4.8MB
-
Filesize
624KB
-
Filesize
4KB
-
Filesize
9.6MB