Analysis

  • max time kernel
    140s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    19-08-2024 18:37

General

  • Target

    ac1f34e80295304e649e7252f93cc587_JaffaCakes118.exe

  • Size

    1.4MB

  • MD5

    ac1f34e80295304e649e7252f93cc587

  • SHA1

    10367ba746ace2b8445eb80b9a204246e5dae1c9

  • SHA256

    e723841b471eff5fa8c94ea4f3d82341dd22b47df2ce2a4d6eea6bb87e75e336

  • SHA512

    6d71192f6fd6479a6d31e8b2209d00204b531eb193a787a9b2db7f89b43b9bcb4fbd07311ccbe3eb431b3650878f3fd9895cef572cbd5cdc3c64fd3c25a938b0

  • SSDEEP

    24576:dGYvGsUH8spk563jwEKJaj9MT05BUw1eErxiRvHV/yuz:5+sI8q3jZU49MTSz1LiV/yuz

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\ac1f34e80295304e649e7252f93cc587_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ac1f34e80295304e649e7252f93cc587_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    PID:2792

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\TCLD365.tmp

    Filesize

    98KB

    MD5

    a468dd92dc57984ec6cf6cf96afafe4e

    SHA1

    6e675c7e2b736d51689d32a657684b3ef9883a8d

    SHA256

    fe7bf5564228ae806002bccb63122fd81c27ecbcebfb061d7ff2dbd2ae5d5e4a

    SHA512

    d849c8c2c9dd52a08ec761fb6a90e165935e5280b3cd1cb9a12700d42250a7a39ff00cdcb5cf124ac45be9853156ce5b38a5018f5fdb7a2dc6128003a22d9423

  • memory/2792-19-0x0000000000400000-0x0000000000607000-memory.dmp

    Filesize

    2.0MB

  • memory/2792-6-0x0000000010000000-0x000000001006A000-memory.dmp

    Filesize

    424KB

  • memory/2792-23-0x0000000000400000-0x0000000000607000-memory.dmp

    Filesize

    2.0MB

  • memory/2792-7-0x0000000000350000-0x0000000000352000-memory.dmp

    Filesize

    8KB

  • memory/2792-13-0x0000000000020000-0x0000000000022000-memory.dmp

    Filesize

    8KB

  • memory/2792-16-0x0000000000350000-0x0000000000352000-memory.dmp

    Filesize

    8KB

  • memory/2792-15-0x0000000010000000-0x000000001006A000-memory.dmp

    Filesize

    424KB

  • memory/2792-14-0x0000000000400000-0x0000000000607000-memory.dmp

    Filesize

    2.0MB

  • memory/2792-25-0x0000000000400000-0x0000000000607000-memory.dmp

    Filesize

    2.0MB

  • memory/2792-0-0x0000000000400000-0x0000000000607000-memory.dmp

    Filesize

    2.0MB

  • memory/2792-42-0x0000000000400000-0x0000000000607000-memory.dmp

    Filesize

    2.0MB

  • memory/2792-1-0x0000000000020000-0x0000000000022000-memory.dmp

    Filesize

    8KB

  • memory/2792-17-0x0000000000400000-0x0000000000607000-memory.dmp

    Filesize

    2.0MB

  • memory/2792-27-0x0000000000400000-0x0000000000607000-memory.dmp

    Filesize

    2.0MB

  • memory/2792-29-0x0000000000400000-0x0000000000607000-memory.dmp

    Filesize

    2.0MB

  • memory/2792-30-0x0000000000400000-0x0000000000607000-memory.dmp

    Filesize

    2.0MB

  • memory/2792-32-0x0000000000400000-0x0000000000607000-memory.dmp

    Filesize

    2.0MB

  • memory/2792-34-0x0000000000400000-0x0000000000607000-memory.dmp

    Filesize

    2.0MB

  • memory/2792-36-0x0000000000400000-0x0000000000607000-memory.dmp

    Filesize

    2.0MB

  • memory/2792-38-0x0000000000400000-0x0000000000607000-memory.dmp

    Filesize

    2.0MB

  • memory/2792-40-0x0000000000400000-0x0000000000607000-memory.dmp

    Filesize

    2.0MB

  • memory/2792-21-0x0000000000400000-0x0000000000607000-memory.dmp

    Filesize

    2.0MB