Analysis
-
max time kernel
140s -
max time network
111s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
12/08/2024, 02:43
General
-
Target
8cff6b6251779a3ac5ab84c1a6e2881c_JaffaCakes118.exe
-
Size
1.8MB
-
MD5
8cff6b6251779a3ac5ab84c1a6e2881c
-
SHA1
46514222bafba71acfd84827ac8e3ea24569a0c4
-
SHA256
ce146d9aa8ed8313e433b54b59542efcc11c1f9177d349c392421860d7679c31
-
SHA512
e6990462f581ee9fdf4937592f44c7b11b26212ac27a19b7010cc88b53a33735717a1e5702b3bb470aca9efe5ff64f9ccb38bb1cc33523d684bf7fb2c7562d08
-
SSDEEP
24576:smAlLaSO5ft1UgZQxnK+kEbzPglRbcKblr0iu0InQflkjXG3/:sRaSmpWKM+RxpulKuzo
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8cff6b6251779a3ac5ab84c1a6e2881c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8cff6b6251779a3ac5ab84c1a6e2881c_JaffaCakes118.exe"1⤵
- Drops file in Drivers directory
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx