Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
17/08/2024, 11:35
Behavioral task
behavioral1
Sample
a26087d8cf76d14fbdf879abfebc0e73_JaffaCakes118.exe
Resource
win7-20240729-en
windows7-x64
6 signatures
150 seconds
General
-
Target
a26087d8cf76d14fbdf879abfebc0e73_JaffaCakes118.exe
-
Size
41KB
-
MD5
a26087d8cf76d14fbdf879abfebc0e73
-
SHA1
9e63b33f1049aceedce2e6f43f03f2d20ac1fbd4
-
SHA256
ba91738d20a690ce9f7772e5a8ab8724a8b1392b9e61227752bc4f07ab9579b0
-
SHA512
1ee995d6cfc99a36acc0e3c2b3e8333ce5776cc0ddc1a018067de23088795b404a92c62efe7e43371b846fe20112a0be2b2456ad9d34e0011ff9e60333827b0b
-
SSDEEP
768:qOQnxjb3emTOlF8XTNmgjaAPiMfyYLHUukm8+PhhSf9NOr+T:qOAx/O+G8zeAP3aSiZNI+T
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\dtvqvgte.sys a26087d8cf76d14fbdf879abfebc0e73_JaffaCakes118.exe -
Loads dropped DLL 1 IoCs
pid Process 1796 a26087d8cf76d14fbdf879abfebc0e73_JaffaCakes118.exe -
resource yara_rule behavioral2/memory/1796-0-0x0000000000400000-0x000000000040C000-memory.dmp upx behavioral2/memory/1796-10-0x0000000000400000-0x000000000040C000-memory.dmp upx -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\dtvqvgte.dll a26087d8cf76d14fbdf879abfebc0e73_JaffaCakes118.exe File created C:\Windows\SysWOW64\dtvqvgte.drv a26087d8cf76d14fbdf879abfebc0e73_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\dtvqvgte.dll a26087d8cf76d14fbdf879abfebc0e73_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a26087d8cf76d14fbdf879abfebc0e73_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1796 a26087d8cf76d14fbdf879abfebc0e73_JaffaCakes118.exe 1796 a26087d8cf76d14fbdf879abfebc0e73_JaffaCakes118.exe 1796 a26087d8cf76d14fbdf879abfebc0e73_JaffaCakes118.exe 1796 a26087d8cf76d14fbdf879abfebc0e73_JaffaCakes118.exe 1796 a26087d8cf76d14fbdf879abfebc0e73_JaffaCakes118.exe 1796 a26087d8cf76d14fbdf879abfebc0e73_JaffaCakes118.exe 1796 a26087d8cf76d14fbdf879abfebc0e73_JaffaCakes118.exe 1796 a26087d8cf76d14fbdf879abfebc0e73_JaffaCakes118.exe 1796 a26087d8cf76d14fbdf879abfebc0e73_JaffaCakes118.exe 1796 a26087d8cf76d14fbdf879abfebc0e73_JaffaCakes118.exe 1796 a26087d8cf76d14fbdf879abfebc0e73_JaffaCakes118.exe 1796 a26087d8cf76d14fbdf879abfebc0e73_JaffaCakes118.exe 1796 a26087d8cf76d14fbdf879abfebc0e73_JaffaCakes118.exe 1796 a26087d8cf76d14fbdf879abfebc0e73_JaffaCakes118.exe 1796 a26087d8cf76d14fbdf879abfebc0e73_JaffaCakes118.exe 1796 a26087d8cf76d14fbdf879abfebc0e73_JaffaCakes118.exe 1796 a26087d8cf76d14fbdf879abfebc0e73_JaffaCakes118.exe 1796 a26087d8cf76d14fbdf879abfebc0e73_JaffaCakes118.exe 1796 a26087d8cf76d14fbdf879abfebc0e73_JaffaCakes118.exe 1796 a26087d8cf76d14fbdf879abfebc0e73_JaffaCakes118.exe 1796 a26087d8cf76d14fbdf879abfebc0e73_JaffaCakes118.exe 1796 a26087d8cf76d14fbdf879abfebc0e73_JaffaCakes118.exe 1796 a26087d8cf76d14fbdf879abfebc0e73_JaffaCakes118.exe 1796 a26087d8cf76d14fbdf879abfebc0e73_JaffaCakes118.exe 1796 a26087d8cf76d14fbdf879abfebc0e73_JaffaCakes118.exe 1796 a26087d8cf76d14fbdf879abfebc0e73_JaffaCakes118.exe 1796 a26087d8cf76d14fbdf879abfebc0e73_JaffaCakes118.exe 1796 a26087d8cf76d14fbdf879abfebc0e73_JaffaCakes118.exe 1796 a26087d8cf76d14fbdf879abfebc0e73_JaffaCakes118.exe 1796 a26087d8cf76d14fbdf879abfebc0e73_JaffaCakes118.exe 1796 a26087d8cf76d14fbdf879abfebc0e73_JaffaCakes118.exe 1796 a26087d8cf76d14fbdf879abfebc0e73_JaffaCakes118.exe 1796 a26087d8cf76d14fbdf879abfebc0e73_JaffaCakes118.exe 1796 a26087d8cf76d14fbdf879abfebc0e73_JaffaCakes118.exe 1796 a26087d8cf76d14fbdf879abfebc0e73_JaffaCakes118.exe 1796 a26087d8cf76d14fbdf879abfebc0e73_JaffaCakes118.exe 1796 a26087d8cf76d14fbdf879abfebc0e73_JaffaCakes118.exe 1796 a26087d8cf76d14fbdf879abfebc0e73_JaffaCakes118.exe 1796 a26087d8cf76d14fbdf879abfebc0e73_JaffaCakes118.exe 1796 a26087d8cf76d14fbdf879abfebc0e73_JaffaCakes118.exe 1796 a26087d8cf76d14fbdf879abfebc0e73_JaffaCakes118.exe 1796 a26087d8cf76d14fbdf879abfebc0e73_JaffaCakes118.exe 1796 a26087d8cf76d14fbdf879abfebc0e73_JaffaCakes118.exe 1796 a26087d8cf76d14fbdf879abfebc0e73_JaffaCakes118.exe 1796 a26087d8cf76d14fbdf879abfebc0e73_JaffaCakes118.exe 1796 a26087d8cf76d14fbdf879abfebc0e73_JaffaCakes118.exe 1796 a26087d8cf76d14fbdf879abfebc0e73_JaffaCakes118.exe 1796 a26087d8cf76d14fbdf879abfebc0e73_JaffaCakes118.exe 1796 a26087d8cf76d14fbdf879abfebc0e73_JaffaCakes118.exe 1796 a26087d8cf76d14fbdf879abfebc0e73_JaffaCakes118.exe 1796 a26087d8cf76d14fbdf879abfebc0e73_JaffaCakes118.exe 1796 a26087d8cf76d14fbdf879abfebc0e73_JaffaCakes118.exe 1796 a26087d8cf76d14fbdf879abfebc0e73_JaffaCakes118.exe 1796 a26087d8cf76d14fbdf879abfebc0e73_JaffaCakes118.exe 1796 a26087d8cf76d14fbdf879abfebc0e73_JaffaCakes118.exe 1796 a26087d8cf76d14fbdf879abfebc0e73_JaffaCakes118.exe 1796 a26087d8cf76d14fbdf879abfebc0e73_JaffaCakes118.exe 1796 a26087d8cf76d14fbdf879abfebc0e73_JaffaCakes118.exe 1796 a26087d8cf76d14fbdf879abfebc0e73_JaffaCakes118.exe 1796 a26087d8cf76d14fbdf879abfebc0e73_JaffaCakes118.exe 1796 a26087d8cf76d14fbdf879abfebc0e73_JaffaCakes118.exe 1796 a26087d8cf76d14fbdf879abfebc0e73_JaffaCakes118.exe 1796 a26087d8cf76d14fbdf879abfebc0e73_JaffaCakes118.exe 1796 a26087d8cf76d14fbdf879abfebc0e73_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a26087d8cf76d14fbdf879abfebc0e73_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a26087d8cf76d14fbdf879abfebc0e73_JaffaCakes118.exe"1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1796
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28KB
MD5ec62abc9d8b37daa478d8eda126dbfa9
SHA1c3b56857f2def80b91f942921208e69327ab0c35
SHA256f708ed60074ce938d85412d8be621d632ab0aa6f7e284a3b899fee030d0e4702
SHA512e4cbe527a35329c7697a05b1ea18ef490b3a1d417bd9d228048608e9f7828268a7676df305c2bc970fa2833db68278a63309bed88821e168f1242e1722610a20