Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
11-08-2024 18:17
General
-
Target
8b731353975e19944d5b4ccd090f0934_JaffaCakes118.exe
-
Size
1.4MB
-
MD5
8b731353975e19944d5b4ccd090f0934
-
SHA1
a4186d02bcf55efb8070c84206a9661c02780a62
-
SHA256
d6e11d02330328e5da0557c3949e901f2ba4723c156a9ec3702563a84f05b860
-
SHA512
68c6346442ded51262213c16dc5209a598ac38dcdb0cbe6f3e520ff4dba4924289bb0b13a9e326dfd43235ee1dfe29a040e224a220c8f84d6309760c5158ecc8
-
SSDEEP
24576:3trQLIMDAuZI8uIRP6ve12IxndyxNcDhZ2TruGpSLif7g28:3tr+IsAghuiiekYndwiZ2TCGpS+fk28
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b731353975e19944d5b4ccd090f0934_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8b731353975e19944d5b4ccd090f0934_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
4KB