Overview

overview

6

Static

static

3

94eff7fc09...18.exe

windows7-x64

6

94eff7fc09...18.exe

windows10-2004-x64

6

Analysis

  • max time kernel
    138s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-08-2024 22:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    94eff7fc09a6aa7330d210fdf2d07b4b_JaffaCakes118.exe

  • Size

    119KB

  • MD5

    94eff7fc09a6aa7330d210fdf2d07b4b

  • SHA1

    b985e7e861db7571a97e3b2dda36e2d63f30bac8

  • SHA256

    5a97407739062d4b065c5cb02cd151993ebf3b15e5387e0b1c8862bc45d37a9b

  • SHA512

    b131b2adf3e8b3f6a5e432e1f86d7d286120fccecd8615a0710cd517fec816935bcd47e43752cf20c84c84798faa171bac1fd16fc7baa608e1b23e42430dbbd3

  • SSDEEP

    1536:Meo9XCfhysP6M9hB93hjdUk0c+jKlNXMih7LWsMHrLO5o+O:zZyUPDuQHWsMHrLO5o

Score
6/10
discoverypersistence

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: RenamesItself 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\94eff7fc09a6aa7330d210fdf2d07b4b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\94eff7fc09a6aa7330d210fdf2d07b4b_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: RenamesItself
    PID:3084

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3084-0-0x0000000000C60000-0x0000000000C84000-memory.dmp

    Filesize

    144KB

    Download