Analysis
-
max time kernel
140s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
23-08-2024 01:31
Behavioral task
behavioral1
Sample
b9d7ba9720825ed4869b4e6711d5780a_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
b9d7ba9720825ed4869b4e6711d5780a_JaffaCakes118.exe
-
Size
779KB
-
MD5
b9d7ba9720825ed4869b4e6711d5780a
-
SHA1
323e69f10b7980cac54759fd8ec52346b3739a26
-
SHA256
99000938a8697e2150906f7b560ea749e3118a86d7307554ad632c269c83a8b9
-
SHA512
4bc9efa3f3461dfb0969c3992f944bcd4c8526e65440bdfe072e4c3367b6ff78927ed0b593e3ea434a5c80273c5489250369088db958171add5cc92fab39ab72
-
SSDEEP
24576:Ob4GrmMyM4NJODs6R+JOgoyBc9LPgjhzmrO8VPtT74Y:64GrmMp6Jksu+JOgoyq9LPgtqiUVN
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/3904-0-0x0000000000400000-0x00000000005DD000-memory.dmp upx behavioral2/memory/3904-141-0x0000000000400000-0x00000000005DD000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b9d7ba9720825ed4869b4e6711d5780a_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3904 b9d7ba9720825ed4869b4e6711d5780a_JaffaCakes118.exe 3904 b9d7ba9720825ed4869b4e6711d5780a_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3904 b9d7ba9720825ed4869b4e6711d5780a_JaffaCakes118.exe 3904 b9d7ba9720825ed4869b4e6711d5780a_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b9d7ba9720825ed4869b4e6711d5780a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b9d7ba9720825ed4869b4e6711d5780a_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3904
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7KB
MD5f297c8005300dbab1b1eedcdce7a787a
SHA18ffdf5a99c773fee6bd4552e16ee17b01e96ca92
SHA25636898487c21daf59cf0b6f1437a109717c9890d3ea815c962a4881f99783ffa9
SHA51217a6702cda2527904b8882ba123ca334e47535d41cc5987535003110d060be684081dde5df638c3d7213742c37f4552d460170e05be2b970050498342b728218
-
Filesize
1KB
MD512210c5c4d22a29ba5aa5a9dce3be980
SHA1a846d94130370099b77d9f469383f283591e3b33
SHA256d3feae909b667e7117cdca18f386fe70cfaf48d99286fa7d66a7157d385d275a
SHA51239d009cbc987d5f42728b6787dd3d03892a9360f3b39b8aa996322778749e48f3bd3112bec094a100ed22f974e15ef84ea3051512d9d4d648aa06e23f719ae3f
-
Filesize
89KB
MD5a34f78c3aecd182144818eb4b7303fda
SHA16fca78dac2797c02d86a4bf6514eda398b7dbe62
SHA256c784376960f3163dc760bc019e72e5fed78203745a5510c69992a39d1d8fe776
SHA512ddec07100503fdad6655d4e90aaac246719e9667611b35b112e4694e2671b43f4c4ef0b87371d3a6e173f7ade9dfd2058e5e165a41c3a250007d49ec18f2419c
-
Filesize
2KB
MD511614da957e14244ade91e50bb2cbf60
SHA1088a204174e81f90ef746f65a980de079518cc2d
SHA2564c7edbc76ee5063dda92a378b41f7d6f4c88489bf6fb9a536794cbfc483e53be
SHA512b994d321160e89c570e348db95eed3932361e167dd9612a21f3d10bffad3e9a1cb4778ac50fb9dfb7389236236137b6b79943b0c77ff3c3aa4aadd550f6defd8