Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
22/08/2024, 22:16
Behavioral task
behavioral1
Sample
b95349148a4c0076bcbe5a7454a824e1_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
b95349148a4c0076bcbe5a7454a824e1_JaffaCakes118.exe
-
Size
467KB
-
MD5
b95349148a4c0076bcbe5a7454a824e1
-
SHA1
6467d8a6e39fd0894bae1a4233cea70c787d527c
-
SHA256
4343be766323c8e91347d5e9e8175ee69d26fb6e52869b7cc68cfd7f70e86375
-
SHA512
95a71d13bdc859cd705913d1291e409f0930676dc4fe88c9745ebd49b713be6104f03477e4b8cfd8918d7024bf6561b8a506f85dd012d25f0395f63b14ee4e52
-
SSDEEP
12288:PuYa5jadMwK80lBQx/MJoScBqNa3Z2xb/QCIQ5cQ/DT:NpdMdfQBqDxryXoDT
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2536-0-0x0000000000400000-0x00000000004BB000-memory.dmp upx behavioral1/memory/2536-185-0x0000000000400000-0x00000000004BB000-memory.dmp upx -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/2536-185-0x0000000000400000-0x00000000004BB000-memory.dmp autoit_exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b95349148a4c0076bcbe5a7454a824e1_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language b95349148a4c0076bcbe5a7454a824e1_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage b95349148a4c0076bcbe5a7454a824e1_JaffaCakes118.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 2536 b95349148a4c0076bcbe5a7454a824e1_JaffaCakes118.exe 2536 b95349148a4c0076bcbe5a7454a824e1_JaffaCakes118.exe 2536 b95349148a4c0076bcbe5a7454a824e1_JaffaCakes118.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 2536 b95349148a4c0076bcbe5a7454a824e1_JaffaCakes118.exe 2536 b95349148a4c0076bcbe5a7454a824e1_JaffaCakes118.exe 2536 b95349148a4c0076bcbe5a7454a824e1_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b95349148a4c0076bcbe5a7454a824e1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b95349148a4c0076bcbe5a7454a824e1_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2536
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
205B
MD5805e4f16c58b5f1031655dd1feb08be2
SHA1a8ba7c247f5cfa1d6f59845842fea03c1d81a29e
SHA25695e0c2e17cde41145a044156b026d1cd848198a73cfabe528a2c48e7def11683
SHA512bb48e08ec9c492322feaab02f4bc8883615c9972430e9853ae8a4588ee48829b30e3885c027d36071a6e631ba2cdb8f46d032893eb1e3b4328db1c4a59589632
-
Filesize
12KB
MD57810a74e49e77c687534046cd1c2b02f
SHA1fbc91547123a805aadb805c4c53809f65113306f
SHA256ba7e102683dda32f9f33e617f4dc4bb77cb0a4d312d95e505a287520773513a0
SHA51237535f368851a2b735642a99e7abe29c1c69ca6adea48b84fcb603b1c34b84cc891cebf3f6076facb0deae61527379e12a7bbddbbbfc45d89e2295de49f213a0