Analysis

  • max time kernel
    149s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-08-2024 10:01

General

  • Target

    c89b8437ce30924abd02fa6813b195f3_JaffaCakes118.exe

  • Size

    3.5MB

  • MD5

    c89b8437ce30924abd02fa6813b195f3

  • SHA1

    d9178cd9ce2e04f45fd893f69c1c64bfb1061b37

  • SHA256

    401e11ce7abb1792c3795d41d067b93df7b09ba6eedadecdd0b84b585dfe35eb

  • SHA512

    04d4cceadedce01a18ec833d73dd3880eba2bc67599a182e08012d32d06f8faeb9b5fc630c5b9eb3b596c21899587ea6eff8109ada77c64d66194250152f246b

  • SSDEEP

    98304:47GaYJriRsR3dh5eAxID5F54anh1lqKjCqtg2bTxRPSn:47GVJwmh5DTan/4KjCSTTxtSn

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c89b8437ce30924abd02fa6813b195f3_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\c89b8437ce30924abd02fa6813b195f3_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:2056

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\9ab75d144e004e00a0b7ca9c07858b8e\filesys.dll

    Filesize

    152KB

    MD5

    26295032c6be74d63d3d652a02375896

    SHA1

    e9d5c2473b70a140d10ad121974b25b56445c714

    SHA256

    9a81ce17e88ad5467aab2ccb9ad75ebd57a2284ac4fbb3d31041a905b5445b96

    SHA512

    32d250563e44e831eea1d214c83d58c03009062708b07a943b64962daaed48ac3d21dcf52a04c9d2784587b79515cf5f59696ffe31acd48fb1b9a1c218d403fe

  • C:\Users\Admin\AppData\Local\Temp\9ab75d144e004e00a0b7ca9c07858b8e\http.dll

    Filesize

    127KB

    MD5

    7908b26ff2ca702931954841c81ad47b

    SHA1

    6828d100d441bf8dc934a49eaf5a250e5b993e16

    SHA256

    fe4ca6e766c718a3ac5759aed22a12c19db43b8a5b4b34b7a69aa40f938b3f1c

    SHA512

    0e09266ea29bdfb9f888d5285605f426773932b80fd57c4e0e01ba00ec7ac5d02fb24d9cc5fc63b40a799bb5c6de30b3118eac4525ed57e22499f97d33058250

  • memory/2056-16-0x0000000000400000-0x00000000004CA000-memory.dmp

    Filesize

    808KB

  • memory/2056-6-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

    Filesize

    368KB

  • memory/2056-21-0x0000000000400000-0x00000000004CA000-memory.dmp

    Filesize

    808KB

  • memory/2056-5-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

    Filesize

    368KB

  • memory/2056-8-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

    Filesize

    368KB

  • memory/2056-10-0x000000007FB80000-0x000000007FBBD000-memory.dmp

    Filesize

    244KB

  • memory/2056-9-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

    Filesize

    368KB

  • memory/2056-7-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

    Filesize

    368KB

  • memory/2056-1-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

    Filesize

    368KB

  • memory/2056-11-0x0000000065340000-0x00000000653D2000-memory.dmp

    Filesize

    584KB

  • memory/2056-12-0x000000006A9D0000-0x000000006AB24000-memory.dmp

    Filesize

    1.3MB

  • memory/2056-14-0x0000000000400000-0x00000000004CA000-memory.dmp

    Filesize

    808KB

  • memory/2056-137-0x0000000004760000-0x0000000004782000-memory.dmp

    Filesize

    136KB

  • memory/2056-3-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

    Filesize

    368KB

  • memory/2056-2-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

    Filesize

    368KB

  • memory/2056-108-0x0000000002200000-0x0000000002228000-memory.dmp

    Filesize

    160KB

  • memory/2056-4-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

    Filesize

    368KB

  • memory/2056-121-0x0000000004760000-0x0000000004782000-memory.dmp

    Filesize

    136KB

  • memory/2056-120-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

    Filesize

    368KB

  • memory/2056-119-0x0000000000400000-0x00000000004CA000-memory.dmp

    Filesize

    808KB

  • memory/2056-124-0x000000007FB80000-0x000000007FBBD000-memory.dmp

    Filesize

    244KB

  • memory/2056-125-0x0000000065340000-0x00000000653D2000-memory.dmp

    Filesize

    584KB

  • memory/2056-126-0x000000006A9D0000-0x000000006AB24000-memory.dmp

    Filesize

    1.3MB

  • memory/2056-127-0x0000000000400000-0x00000000004CA000-memory.dmp

    Filesize

    808KB

  • memory/2056-135-0x0000000002200000-0x0000000002228000-memory.dmp

    Filesize

    160KB

  • memory/2056-0-0x0000000000400000-0x00000000004CA000-memory.dmp

    Filesize

    808KB