Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/08/2024, 04:05

General

  • Target

    88ee442ab9964cce8c20ea5acaf3a36c_JaffaCakes118.exe

  • Size

    581KB

  • MD5

    88ee442ab9964cce8c20ea5acaf3a36c

  • SHA1

    0fa898eec6f1e8719f9cffbed46bbd980cd3c475

  • SHA256

    d7c5bd3b78edcabf84fa4696c9b09a6a3a896dc9bc7dd79a02a3d4a76f7a5867

  • SHA512

    2e9b4173419f752346477a91600e2394c5b577ce696c4e093d29225390963efa44accb919aa064377807779c0f494b2c96476c81280e3184e10e709f4da9d96f

  • SSDEEP

    12288:qqiq2Rk9mLxb+KsixcVwAl4X/oPzU5SB9uXWg:qqifk9Ab+xCwfl4voPzQXGg

Score
7/10

Malware Config

Signatures

  • UPX packed file 16 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\88ee442ab9964cce8c20ea5acaf3a36c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\88ee442ab9964cce8c20ea5acaf3a36c_JaffaCakes118.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    PID:1624

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Windows\SDA_APPS.INI

          Filesize

          57B

          MD5

          f6fc1accdc415561a87875ec68b71e3c

          SHA1

          091ab2071f670e926d7d38335d9b0cf71bb9c795

          SHA256

          58483f9e0080237544ae1354e7ccdc23beda01df8ee4569f2ab57c23e37288e5

          SHA512

          bf163389bfe205158ce64b96f1280308e615372ad969a037016eeb1aa08aa3b26d4f249b2a287d762c4512f7732fd67fe6dae44592db07c71f2610ea3a42cb72

        • memory/1624-14-0x0000000000400000-0x00000000005EE000-memory.dmp

          Filesize

          1.9MB

        • memory/1624-17-0x0000000000400000-0x00000000005EE000-memory.dmp

          Filesize

          1.9MB

        • memory/1624-9-0x0000000000400000-0x00000000005EE000-memory.dmp

          Filesize

          1.9MB

        • memory/1624-10-0x0000000000400000-0x00000000005EE000-memory.dmp

          Filesize

          1.9MB

        • memory/1624-11-0x0000000000400000-0x00000000005EE000-memory.dmp

          Filesize

          1.9MB

        • memory/1624-12-0x0000000002390000-0x0000000002391000-memory.dmp

          Filesize

          4KB

        • memory/1624-13-0x0000000000400000-0x00000000005EE000-memory.dmp

          Filesize

          1.9MB

        • memory/1624-0-0x0000000000400000-0x00000000005EE000-memory.dmp

          Filesize

          1.9MB

        • memory/1624-1-0x0000000002390000-0x0000000002391000-memory.dmp

          Filesize

          4KB

        • memory/1624-15-0x0000000000400000-0x00000000005EE000-memory.dmp

          Filesize

          1.9MB

        • memory/1624-16-0x0000000000400000-0x00000000005EE000-memory.dmp

          Filesize

          1.9MB

        • memory/1624-18-0x0000000000400000-0x00000000005EE000-memory.dmp

          Filesize

          1.9MB

        • memory/1624-19-0x0000000000400000-0x00000000005EE000-memory.dmp

          Filesize

          1.9MB

        • memory/1624-20-0x0000000000400000-0x00000000005EE000-memory.dmp

          Filesize

          1.9MB

        • memory/1624-21-0x0000000000400000-0x00000000005EE000-memory.dmp

          Filesize

          1.9MB

        • memory/1624-22-0x0000000000400000-0x00000000005EE000-memory.dmp

          Filesize

          1.9MB

        • memory/1624-23-0x0000000000400000-0x00000000005EE000-memory.dmp

          Filesize

          1.9MB

        • memory/1624-24-0x0000000000400000-0x00000000005EE000-memory.dmp

          Filesize

          1.9MB