Analysis
-
max time kernel
100s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
11-09-2024 15:16
Behavioral task
behavioral1
Sample
daa23344a9b61c48d3cf4823945eba2e_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
daa23344a9b61c48d3cf4823945eba2e_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
daa23344a9b61c48d3cf4823945eba2e_JaffaCakes118.exe
-
Size
772KB
-
MD5
daa23344a9b61c48d3cf4823945eba2e
-
SHA1
e858854025bedfbe983ee530e1d912fad53b628a
-
SHA256
e5e301a72b799f8140c7b2c1cae0d55fe8aa9cb478126f53c9ba4c72ae9e4926
-
SHA512
8e634b713b5c5e936e8f36597a1b938ff5074735a08cb7a089f6e6db5d684cd8f512a0f53f2b0acee768bedb80c7583a02ec788559f90ac89075a43d894fbc20
-
SSDEEP
24576:ztkmHEgSewkmchJGsORtn9qT8+Yg035Yh:J/kGmchzqiY3uh
Malware Config
Signatures
-
FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language daa23344a9b61c48d3cf4823945eba2e_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language daa23344a9b61c48d3cf4823945eba2e_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language daa23344a9b61c48d3cf4823945eba2e_JaffaCakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2272 daa23344a9b61c48d3cf4823945eba2e_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3052 wrote to memory of 2272 3052 daa23344a9b61c48d3cf4823945eba2e_JaffaCakes118.exe 31 PID 3052 wrote to memory of 2272 3052 daa23344a9b61c48d3cf4823945eba2e_JaffaCakes118.exe 31 PID 3052 wrote to memory of 2272 3052 daa23344a9b61c48d3cf4823945eba2e_JaffaCakes118.exe 31 PID 3052 wrote to memory of 2272 3052 daa23344a9b61c48d3cf4823945eba2e_JaffaCakes118.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\daa23344a9b61c48d3cf4823945eba2e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\daa23344a9b61c48d3cf4823945eba2e_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
PID:1760
-
C:\Users\Admin\AppData\Local\Temp\daa23344a9b61c48d3cf4823945eba2e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\daa23344a9b61c48d3cf4823945eba2e_JaffaCakes118.exe" -service -lunch1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\daa23344a9b61c48d3cf4823945eba2e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\daa23344a9b61c48d3cf4823945eba2e_JaffaCakes118.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:2272
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
340B
MD5a58d62a6071c771e18ebc6c81d95a197
SHA11fb06188318425fea81c723a74a1d40b1feb98f2
SHA256a89f0029bc359830f19d99edbb55be96b17886ae189d8715e7ddcaea6f23b3ec
SHA512b516f51c375d07779759f8df4cc1ef7482626f7eb6a3c4b58e2ba32fcbc5594b814ee2e0a53bc5f3b15147417aba49ad79fe5544e1343529980f5a527cac914a