Analysis
-
max time kernel
140s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06/09/2024, 00:37
Static task
static1
Behavioral task
behavioral1
Sample
ce420efa0924f5a91929870a0b899049_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
ce420efa0924f5a91929870a0b899049_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
ce420efa0924f5a91929870a0b899049_JaffaCakes118.exe
-
Size
315KB
-
MD5
ce420efa0924f5a91929870a0b899049
-
SHA1
07390158c08362711050a2de10ceecc01ba3ddbf
-
SHA256
1f5ee96a5e76c57255a656bf66b3909b148f5a54f07e07d658eaf4e87f8067d7
-
SHA512
dd0dc17c43f453fb308312b9c765332be74d6f782132662d4763b9d0ff7056eae8a843a861e0a2e3433862fd89f4c7c9fbb24457e3b6ec90244e12186542d095
-
SSDEEP
6144:WXDXL0BvnjbJDB7VHMkzQB9qnxcoL/3Rn:Qb0BPjb37ykeuxco7
Malware Config
Signatures
-
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\System\360Safe.ico ce420efa0924f5a91929870a0b899049_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\System\360Sd.ico ce420efa0924f5a91929870a0b899049_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ce420efa0924f5a91929870a0b899049_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 880 ce420efa0924f5a91929870a0b899049_JaffaCakes118.exe 880 ce420efa0924f5a91929870a0b899049_JaffaCakes118.exe 880 ce420efa0924f5a91929870a0b899049_JaffaCakes118.exe 880 ce420efa0924f5a91929870a0b899049_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ce420efa0924f5a91929870a0b899049_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ce420efa0924f5a91929870a0b899049_JaffaCakes118.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:880