Analysis
- max time kernel
94s - max time network
125s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
18/08/2024, 20:45
General
- Target a824e91c095c8e908b7e37f09aab1cdb_JaffaCakes118.exe
- Size 45KB
- Sample240818-zj3evstbmd
- SHA256 0c199243534878a756c90b33e44524182e5fe44b1387ef7e3bb50b8d6ee47e9d
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a824e91c095c8e908b7e37f09aab1cdb_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a824e91c095c8e908b7e37f09aab1cdb_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1220-0-0x0000000074802000-0x0000000074803000-memory.dmp
memory/1220-1-0x0000000074800000-0x0000000074DB1000-memory.dmp
memory/1220-2-0x0000000074800000-0x0000000074DB1000-memory.dmp
memory/1220-5-0x0000000074800000-0x0000000074DB1000-memory.dmp
memory/1220-6-0x0000000074800000-0x0000000074DB1000-memory.dmp
memory/1220-7-0x0000000074800000-0x0000000074DB1000-memory.dmp
memory/1220-8-0x0000000074800000-0x0000000074DB1000-memory.dmp
memory/1220-9-0x0000000074800000-0x0000000074DB1000-memory.dmp
memory/1220-16-0x0000000074800000-0x0000000074DB1000-memory.dmp
memory/1220-21-0x0000000074802000-0x0000000074803000-memory.dmp
memory/1220-22-0x0000000074800000-0x0000000074DB1000-memory.dmp