Analysis

  • max time kernel
    140s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-08-2024 01:31

General

  • Target

    b9d7ba9720825ed4869b4e6711d5780a_JaffaCakes118.exe

  • Size

    779KB

  • MD5

    b9d7ba9720825ed4869b4e6711d5780a

  • SHA1

    323e69f10b7980cac54759fd8ec52346b3739a26

  • SHA256

    99000938a8697e2150906f7b560ea749e3118a86d7307554ad632c269c83a8b9

  • SHA512

    4bc9efa3f3461dfb0969c3992f944bcd4c8526e65440bdfe072e4c3367b6ff78927ed0b593e3ea434a5c80273c5489250369088db958171add5cc92fab39ab72

  • SSDEEP

    24576:Ob4GrmMyM4NJODs6R+JOgoyBc9LPgjhzmrO8VPtT74Y:64GrmMp6Jksu+JOgoyq9LPgtqiUVN

Score
7/10

Malware Config

Signatures

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b9d7ba9720825ed4869b4e6711d5780a_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\b9d7ba9720825ed4869b4e6711d5780a_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3904

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\mediaget-installer-tmp\css\style.css

    Filesize

    7KB

    MD5

    f297c8005300dbab1b1eedcdce7a787a

    SHA1

    8ffdf5a99c773fee6bd4552e16ee17b01e96ca92

    SHA256

    36898487c21daf59cf0b6f1437a109717c9890d3ea815c962a4881f99783ffa9

    SHA512

    17a6702cda2527904b8882ba123ca334e47535d41cc5987535003110d060be684081dde5df638c3d7213742c37f4552d460170e05be2b970050498342b728218

  • C:\Users\Admin\AppData\Local\Temp\mediaget-installer-tmp\img\start_en.jpg

    Filesize

    1KB

    MD5

    12210c5c4d22a29ba5aa5a9dce3be980

    SHA1

    a846d94130370099b77d9f469383f283591e3b33

    SHA256

    d3feae909b667e7117cdca18f386fe70cfaf48d99286fa7d66a7157d385d275a

    SHA512

    39d009cbc987d5f42728b6787dd3d03892a9360f3b39b8aa996322778749e48f3bd3112bec094a100ed22f974e15ef84ea3051512d9d4d648aa06e23f719ae3f

  • C:\Users\Admin\AppData\Local\Temp\mediaget-installer-tmp\scripts\jquery.js

    Filesize

    89KB

    MD5

    a34f78c3aecd182144818eb4b7303fda

    SHA1

    6fca78dac2797c02d86a4bf6514eda398b7dbe62

    SHA256

    c784376960f3163dc760bc019e72e5fed78203745a5510c69992a39d1d8fe776

    SHA512

    ddec07100503fdad6655d4e90aaac246719e9667611b35b112e4694e2671b43f4c4ef0b87371d3a6e173f7ade9dfd2058e5e165a41c3a250007d49ec18f2419c

  • C:\Users\Admin\AppData\Local\Temp\mediaget-installer-tmp\scripts\scripts.js

    Filesize

    2KB

    MD5

    11614da957e14244ade91e50bb2cbf60

    SHA1

    088a204174e81f90ef746f65a980de079518cc2d

    SHA256

    4c7edbc76ee5063dda92a378b41f7d6f4c88489bf6fb9a536794cbfc483e53be

    SHA512

    b994d321160e89c570e348db95eed3932361e167dd9612a21f3d10bffad3e9a1cb4778ac50fb9dfb7389236236137b6b79943b0c77ff3c3aa4aadd550f6defd8

  • memory/3904-0-0x0000000000400000-0x00000000005DD000-memory.dmp

    Filesize

    1.9MB

  • memory/3904-1-0x0000000000C10000-0x0000000000C11000-memory.dmp

    Filesize

    4KB

  • memory/3904-141-0x0000000000400000-0x00000000005DD000-memory.dmp

    Filesize

    1.9MB

  • memory/3904-143-0x0000000000C10000-0x0000000000C11000-memory.dmp

    Filesize

    4KB