Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
29-08-2024 03:01
Behavioral task
behavioral1
Sample
c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
7 signatures
150 seconds
General
-
Target
c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe
-
Size
372KB
-
MD5
c81df45d8defee39bd0376af57145b79
-
SHA1
f445492c82cf8629081b4f9dcf93ca80cb7e6c34
-
SHA256
775e74e9a25b12252e4b9f80eaa008782c476c5679180097d51eb087df10df2f
-
SHA512
08cc80068726c0afbc9d73c90502bd4f482658cbd50b6ad636a09f8f9a24c9970718b4b96ab1aeb9358ed7ecceea06d4ba33cc41cf710f0d67cba2d2e189e67c
-
SSDEEP
6144:M6n4ydouuVdiREe3PYBifnYRECk0WfGm7vq588m+wPC2oMjwUf0rs9PUNx5:M6nTohdYEQPYInYrZWOT7Clos5mH
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/2528-0-0x0000000000400000-0x000000000049E000-memory.dmp upx behavioral2/memory/2528-1-0x0000000000400000-0x000000000049E000-memory.dmp upx behavioral2/memory/2528-2-0x0000000000400000-0x000000000049E000-memory.dmp upx behavioral2/memory/2528-4-0x0000000000400000-0x000000000049E000-memory.dmp upx -
AutoIT Executable 3 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/2528-1-0x0000000000400000-0x000000000049E000-memory.dmp autoit_exe behavioral2/memory/2528-2-0x0000000000400000-0x000000000049E000-memory.dmp autoit_exe behavioral2/memory/2528-4-0x0000000000400000-0x000000000049E000-memory.dmp autoit_exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe 2528 c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c81df45d8defee39bd0376af57145b79_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2528