Analysis

  • max time kernel
    64s
  • max time network
    53s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    27-08-2024 18:34

General

  • Target

    c5812a6d0c2a68bc656040a8cc0155a8_JaffaCakes118.exe

  • Size

    352KB

  • MD5

    c5812a6d0c2a68bc656040a8cc0155a8

  • SHA1

    95f75102e0c405c31948e3d90ceef171ec4623fd

  • SHA256

    8ec41d21f41d9b5bc67144f96248d6d22fc66cc43cae5d59db4385ff3c207f57

  • SHA512

    83dc9b38e47758a30085e31f390096ccc7415ef67221aa02230af69c911a929704fdcbe0fcc64fc3b1b6af04ee55f11421f8b836d56c417685e46c9a426fd2a6

  • SSDEEP

    3072:gfXBgU55IF7frLVYUwtqTr84c4ryLg48kP8q9fV/l/Fnk+1CyDNiidY/I7:OXW1rLV/wtqT3ragnSz7/jl7

Malware Config

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\c5812a6d0c2a68bc656040a8cc0155a8_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\c5812a6d0c2a68bc656040a8cc0155a8_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:2412

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2412-1-0x0000000000570000-0x0000000000670000-memory.dmp

    Filesize

    1024KB

  • memory/2412-2-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

  • memory/2412-3-0x0000000000570000-0x0000000000670000-memory.dmp

    Filesize

    1024KB

  • memory/2412-4-0x0000000000400000-0x0000000000483000-memory.dmp

    Filesize

    524KB

  • memory/2412-5-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

  • memory/2412-9-0x0000000000400000-0x0000000000483000-memory.dmp

    Filesize

    524KB

  • memory/2412-11-0x0000000000400000-0x0000000000483000-memory.dmp

    Filesize

    524KB

  • memory/2412-12-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB