Analysis

  • max time kernel
    149s
  • max time network
    123s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/08/2024, 06:46

General

  • Target

    b6b73152c09d0c587d86a13a8080bf08_JaffaCakes118.exe

  • Size

    32KB

  • MD5

    b6b73152c09d0c587d86a13a8080bf08

  • SHA1

    221717d191773829e4ab9c8aaba33fe3404d0d1c

  • SHA256

    96d56a0438eda144af730e1e11460677bac9bbec02608f2b41c84d5feab903cd

  • SHA512

    fef68cbe82324cf583fe006f7b9b91b9293b640202d67811437c5e146b94597ec92a2a1f0424ca9f055752dc116c602e836d0b260b89df10ad7459f4b02615ef

  • SSDEEP

    768:7XnBZkctE9JYo0PWRx+deVmG2w+k1Nwwbhws9eFMu9:7Bbe9JYBTTXw+k1NwwqG6

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b6b73152c09d0c587d86a13a8080bf08_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\b6b73152c09d0c587d86a13a8080bf08_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: RenamesItself
    • Suspicious use of SetWindowsHookEx
    PID:4472

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4472-0-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/4472-5-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB