Analysis
-
max time kernel
134s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
21-08-2024 00:32
General
-
Target
b1797d3e9b84c45b0ce50833b999597a_JaffaCakes118.exe
-
Size
3.0MB
-
MD5
b1797d3e9b84c45b0ce50833b999597a
-
SHA1
d40e577bc02c4e0a7879c11e13fbc49712f78fc4
-
SHA256
0834bed099ba3de0e050000e023904624a2b70a63fdbbb4baa90e08ac3a268da
-
SHA512
2ccf15f4d2e7d606632683f6514974720237a9c385a3e2d067683f90e3923ce8ba54fb20d1607d76cb4bb0e2f20a3bd9b0887bdf896e46d5939822c1db268a72
-
SSDEEP
49152:Z/qCSmmE7yrvlyhP0UXnBxpgzes+F5RN7PdTW+jPg/NX7x8dYtGVVWZ:Z/qCSm+iP0KnBxpgaz5zLU/N
Score
6/10
Malware Config
Signatures
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b1797d3e9b84c45b0ce50833b999597a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b1797d3e9b84c45b0ce50833b999597a_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4152,i,8548254608087149642,10333768245962368401,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:81⤵