Analysis
-
max time kernel
141s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
20/08/2024, 20:28
General
-
Target
b0b6cdda32a4450055c3a3f756f5fb20_JaffaCakes118.exe
-
Size
2.0MB
-
MD5
b0b6cdda32a4450055c3a3f756f5fb20
-
SHA1
9f30c11c3fcbedb3ae09ff31c1d15ddd773629ed
-
SHA256
163bc19b4cfdaa3d6479bb61dd626c6f72ca1a2ed4c27a6094ad385ed7c6ef41
-
SHA512
fdfbb40fa9d86f61f0d4a6c91de5d919b82895a9a98889d25a879ac564b14af032ebfc0a671c3e32828056bb1eb15bd186cb4f8848d27b2d5429d4811e9f43bd
-
SSDEEP
49152:SkrpuxLAn+21L0LoIm9OP7RylH3Wks9pA29uhlm8:Scw4+21L59Od79pjQlm
Malware Config
Signatures
-
UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b0b6cdda32a4450055c3a3f756f5fb20_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b0b6cdda32a4450055c3a3f756f5fb20_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.7MB
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB