Analysis
-
max time kernel
140s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
11/09/2024, 06:37
General
-
Target
d9cc122365c63fb4e951950037ca82cb_JaffaCakes118.exe
-
Size
93KB
-
MD5
d9cc122365c63fb4e951950037ca82cb
-
SHA1
3a9c4d9f5ba0714395fbe8b0ca36d25d12fc29eb
-
SHA256
2f0218a1155370086b572bf32c41955552e2cb16aaa4c9bc78617a2afdce6a29
-
SHA512
b68219654a6bb38a8d64028f157411be1e03d58fad04a06621764fb5583fe9b3d2830f2aeb75af7864d09831406a2315b078c7c088301984bae7d5293c85a127
-
SSDEEP
1536:lHfF21RWzOfb0cHvARd8HiWUvx/YHyQE8+U49zma8k07yA31nouy8:l/ATfb0c4AUp/KyQEhJKk0hout
Score
7/10
Malware Config
Signatures
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: RenamesItself 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d9cc122365c63fb4e951950037ca82cb_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d9cc122365c63fb4e951950037ca82cb_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
292KB
-
Filesize
292KB