Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
23-08-2024 21:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bd425a49d0da092fce148a514429b200_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
bd425a49d0da092fce148a514429b200_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
bd425a49d0da092fce148a514429b200_JaffaCakes118.exe
-
Size
24KB
-
MD5
bd425a49d0da092fce148a514429b200
-
SHA1
4ed2cde86022c7ffa82c91cfc73cf4adf020cde3
-
SHA256
68a11ecaf9c4e992c5dfb5f13c2bc3fe8a68997c9fd205ee048fd3e27074a2d7
-
SHA512
fe65c4d888f84e535d7ade08226f79db42ee878b2ab96064ed6e81aeca13b6901c033262421473594f7a18cd605d3cd7e2c5e2e31e6506f58c73dc3278f8ea76
-
SSDEEP
192:gfRpzt1GGQQx3/jEA5MC020m3rgVB5UjvIwsvq4DBG9TEmj:6pztLjEA5v08bgVBGzIwsvxDBGWmj
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bd425a49d0da092fce148a514429b200_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4552 bd425a49d0da092fce148a514429b200_JaffaCakes118.exe 4552 bd425a49d0da092fce148a514429b200_JaffaCakes118.exe 4552 bd425a49d0da092fce148a514429b200_JaffaCakes118.exe 4552 bd425a49d0da092fce148a514429b200_JaffaCakes118.exe 4552 bd425a49d0da092fce148a514429b200_JaffaCakes118.exe 4552 bd425a49d0da092fce148a514429b200_JaffaCakes118.exe 4552 bd425a49d0da092fce148a514429b200_JaffaCakes118.exe 4552 bd425a49d0da092fce148a514429b200_JaffaCakes118.exe 4552 bd425a49d0da092fce148a514429b200_JaffaCakes118.exe 4552 bd425a49d0da092fce148a514429b200_JaffaCakes118.exe 4552 bd425a49d0da092fce148a514429b200_JaffaCakes118.exe 4552 bd425a49d0da092fce148a514429b200_JaffaCakes118.exe 4552 bd425a49d0da092fce148a514429b200_JaffaCakes118.exe 4552 bd425a49d0da092fce148a514429b200_JaffaCakes118.exe 4552 bd425a49d0da092fce148a514429b200_JaffaCakes118.exe 4552 bd425a49d0da092fce148a514429b200_JaffaCakes118.exe 4552 bd425a49d0da092fce148a514429b200_JaffaCakes118.exe 4552 bd425a49d0da092fce148a514429b200_JaffaCakes118.exe 4552 bd425a49d0da092fce148a514429b200_JaffaCakes118.exe 4552 bd425a49d0da092fce148a514429b200_JaffaCakes118.exe 4552 bd425a49d0da092fce148a514429b200_JaffaCakes118.exe 4552 bd425a49d0da092fce148a514429b200_JaffaCakes118.exe 4552 bd425a49d0da092fce148a514429b200_JaffaCakes118.exe 4552 bd425a49d0da092fce148a514429b200_JaffaCakes118.exe 4552 bd425a49d0da092fce148a514429b200_JaffaCakes118.exe 4552 bd425a49d0da092fce148a514429b200_JaffaCakes118.exe 4552 bd425a49d0da092fce148a514429b200_JaffaCakes118.exe 4552 bd425a49d0da092fce148a514429b200_JaffaCakes118.exe 4552 bd425a49d0da092fce148a514429b200_JaffaCakes118.exe 4552 bd425a49d0da092fce148a514429b200_JaffaCakes118.exe 4552 bd425a49d0da092fce148a514429b200_JaffaCakes118.exe 4552 bd425a49d0da092fce148a514429b200_JaffaCakes118.exe 4552 bd425a49d0da092fce148a514429b200_JaffaCakes118.exe 4552 bd425a49d0da092fce148a514429b200_JaffaCakes118.exe 4552 bd425a49d0da092fce148a514429b200_JaffaCakes118.exe 4552 bd425a49d0da092fce148a514429b200_JaffaCakes118.exe 4552 bd425a49d0da092fce148a514429b200_JaffaCakes118.exe 4552 bd425a49d0da092fce148a514429b200_JaffaCakes118.exe 4552 bd425a49d0da092fce148a514429b200_JaffaCakes118.exe 4552 bd425a49d0da092fce148a514429b200_JaffaCakes118.exe 4552 bd425a49d0da092fce148a514429b200_JaffaCakes118.exe 4552 bd425a49d0da092fce148a514429b200_JaffaCakes118.exe 4552 bd425a49d0da092fce148a514429b200_JaffaCakes118.exe 4552 bd425a49d0da092fce148a514429b200_JaffaCakes118.exe 4552 bd425a49d0da092fce148a514429b200_JaffaCakes118.exe 4552 bd425a49d0da092fce148a514429b200_JaffaCakes118.exe 4552 bd425a49d0da092fce148a514429b200_JaffaCakes118.exe 4552 bd425a49d0da092fce148a514429b200_JaffaCakes118.exe 4552 bd425a49d0da092fce148a514429b200_JaffaCakes118.exe 4552 bd425a49d0da092fce148a514429b200_JaffaCakes118.exe 4552 bd425a49d0da092fce148a514429b200_JaffaCakes118.exe 4552 bd425a49d0da092fce148a514429b200_JaffaCakes118.exe 4552 bd425a49d0da092fce148a514429b200_JaffaCakes118.exe 4552 bd425a49d0da092fce148a514429b200_JaffaCakes118.exe 4552 bd425a49d0da092fce148a514429b200_JaffaCakes118.exe 4552 bd425a49d0da092fce148a514429b200_JaffaCakes118.exe 4552 bd425a49d0da092fce148a514429b200_JaffaCakes118.exe 4552 bd425a49d0da092fce148a514429b200_JaffaCakes118.exe 4552 bd425a49d0da092fce148a514429b200_JaffaCakes118.exe 4552 bd425a49d0da092fce148a514429b200_JaffaCakes118.exe 4552 bd425a49d0da092fce148a514429b200_JaffaCakes118.exe 4552 bd425a49d0da092fce148a514429b200_JaffaCakes118.exe 4552 bd425a49d0da092fce148a514429b200_JaffaCakes118.exe 4552 bd425a49d0da092fce148a514429b200_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4552 bd425a49d0da092fce148a514429b200_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd425a49d0da092fce148a514429b200_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\bd425a49d0da092fce148a514429b200_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4552