Analysis

  • max time kernel
    135s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-08-2024 19:09

General

  • Target

    c972a9470646d06c63731233decc49d2_JaffaCakes118.exe

  • Size

    339KB

  • MD5

    c972a9470646d06c63731233decc49d2

  • SHA1

    cc2c2f67a40b086fe285f09e83fa5533b3ae4a3c

  • SHA256

    06f38b5394ff95368f27a38414df56120dac05b9f7a4da70bfea7360cb462d63

  • SHA512

    cb8a0d0cdefb91645d2733c2d9f03452cd6632ff6dee3b5a2a23302ed67d2e372227cf196aca4d8d077f2ab05b9e2d8951cd80e80889d1cee276cdee66cf969f

  • SSDEEP

    6144:1q0+h1HyQIhGtnnT67Xe6yt9A0unbjCDODJqewNKxZ1NXPm/yZO7hkm3phTK1q5R:1yh1SfGtQXdc9A0uHCDODJqe0yZ1NXPY

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\c972a9470646d06c63731233decc49d2_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\c972a9470646d06c63731233decc49d2_JaffaCakes118.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    PID:4672

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4672-0-0x0000000000E50000-0x0000000000E51000-memory.dmp

    Filesize

    4KB

  • memory/4672-1-0x0000000000E60000-0x0000000000E61000-memory.dmp

    Filesize

    4KB

  • memory/4672-2-0x0000000000F70000-0x0000000000F71000-memory.dmp

    Filesize

    4KB

  • memory/4672-3-0x0000000000F80000-0x0000000000F81000-memory.dmp

    Filesize

    4KB

  • memory/4672-4-0x0000000001880000-0x00000000018A0000-memory.dmp

    Filesize

    128KB

  • memory/4672-9-0x0000000001880000-0x00000000018A0000-memory.dmp

    Filesize

    128KB

  • memory/4672-5-0x0000000004520000-0x000000000454F000-memory.dmp

    Filesize

    188KB

  • memory/4672-17-0x0000000001880000-0x00000000018A0000-memory.dmp

    Filesize

    128KB