Analysis
-
max time kernel
140s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
08/09/2024, 07:18
General
-
Target
d3d30083623b2e568768a681ac0824fe_JaffaCakes118.exe
-
Size
703KB
-
MD5
d3d30083623b2e568768a681ac0824fe
-
SHA1
ad249ee743f382ba31069fbfbdf3af99760534c6
-
SHA256
5df870273c536ac0c793dfa0c6f7183cfb54abd03c1718897852178058ce7869
-
SHA512
9f303d2409662a3c9d69e759994ddacf30594da55e708687dde50b16170d15504663b540935a18b25b9c30f349684475c31674cc3cec51a0fb860782491ffced
-
SSDEEP
12288:i9AAp4czpQD+91611pf8IwmMvMFpKIMWXDM+erF7Id1A84IX05ab:WAAK0QD+r6bpfimM0bWa87sh
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Drops file in System32 directory 6 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d3d30083623b2e568768a681ac0824fe_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d3d30083623b2e568768a681ac0824fe_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\temp1.exe"C:\Windows\system32\temp1.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\temp2.exe"C:\Windows\system32\temp2.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
120KB
MD5bb6984e6a89c87cfaf07f7ca3e73ecb1
SHA13f4e5eb66894c580a1a06a9f728cf103fddbb892
SHA2564fb13ca751cb28699f1eeddbe6d92ff1e642dceddab401825f70c1935f61496a
SHA512597a81fa0c93165f31e3889d70305cc753e9198554e6e40881d78451580f17b081dc97ab39c77cbf1f5225d4e148a3ed144a7655ec1448cb55ec22325ea7853b
-
Filesize
550KB
MD53a8c5087047d9525e57667a102116ecc
SHA1916dd63efe1f2bb7a56b089524b139c9fced3652
SHA25660bfa3ba27ceb23f740b913be748867d0b8d6e47474c341cf0b41fe2e729c9fe
SHA512efddab8c52ddabf252b2c4f8f2de0a4c32f30dc431df21c79eddfb0c0219f2243cb439e8b6c2317af7046a05ae0b32ad02e074982f8b781a60c037070c54680b
-
Filesize
160KB
-
Filesize
816KB
-
Filesize
328KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
816KB
-
Filesize
328KB
-
Filesize
4KB
-
Filesize
4KB