Analysis
-
max time kernel
140s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
13-09-2024 06:39
Static task
static1
Behavioral task
behavioral1
Sample
dde0e20e622571cd49c616e02ce54d68_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
dde0e20e622571cd49c616e02ce54d68_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
dde0e20e622571cd49c616e02ce54d68_JaffaCakes118.exe
-
Size
1.1MB
-
MD5
dde0e20e622571cd49c616e02ce54d68
-
SHA1
660d245f4d26674e2d39c0eb1b4fcc1ba4ad5fa5
-
SHA256
741c6bb5b6dc77b8978e7dc0550abbfb6966b502306fecc1d82a145a13903bb8
-
SHA512
db37104d8d5e9f5761cc9d327dc5b3d34271904911e11c92fc4127d08b5e2d800965d9eae620769efe7465ebd73e8b8b8298270bcdfa9d4a1b7730613c3108e1
-
SSDEEP
24576:QSVvlmKo7Gd0AmhNwyYwNtR3Geqbp/R4bdTH7tQZTXaA:p9zkG03QvwNtR3G4xTH7CZF
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dde0e20e622571cd49c616e02ce54d68_JaffaCakes118.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 2280 dde0e20e622571cd49c616e02ce54d68_JaffaCakes118.exe 2280 dde0e20e622571cd49c616e02ce54d68_JaffaCakes118.exe 2280 dde0e20e622571cd49c616e02ce54d68_JaffaCakes118.exe 2280 dde0e20e622571cd49c616e02ce54d68_JaffaCakes118.exe -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 2280 dde0e20e622571cd49c616e02ce54d68_JaffaCakes118.exe 2280 dde0e20e622571cd49c616e02ce54d68_JaffaCakes118.exe 2280 dde0e20e622571cd49c616e02ce54d68_JaffaCakes118.exe 2280 dde0e20e622571cd49c616e02ce54d68_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dde0e20e622571cd49c616e02ce54d68_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\dde0e20e622571cd49c616e02ce54d68_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2280
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
153B
MD5abaff78626c00b1bc0727f7467c9c5f1
SHA1fdda55c6bf8a33cfb88954e18d9aed18aab073c1
SHA256cd31b86ed3e082cbf465f01ce16c7e35c67a324379f8c4190d62f6be23788d04
SHA512d14e3f84f2d039cc1d614f7f21bdf2a593b71b64667fbd7a6a4820264a50ada04983a1a2769c89f3ef86c82b9835945e9cc271c7d4fed854bd0e6a8716e4aeff