Analysis

  • max time kernel
    140s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    13-09-2024 06:39

General

  • Target

    dde0e20e622571cd49c616e02ce54d68_JaffaCakes118.exe

  • Size

    1.1MB

  • MD5

    dde0e20e622571cd49c616e02ce54d68

  • SHA1

    660d245f4d26674e2d39c0eb1b4fcc1ba4ad5fa5

  • SHA256

    741c6bb5b6dc77b8978e7dc0550abbfb6966b502306fecc1d82a145a13903bb8

  • SHA512

    db37104d8d5e9f5761cc9d327dc5b3d34271904911e11c92fc4127d08b5e2d800965d9eae620769efe7465ebd73e8b8b8298270bcdfa9d4a1b7730613c3108e1

  • SSDEEP

    24576:QSVvlmKo7Gd0AmhNwyYwNtR3Geqbp/R4bdTH7tQZTXaA:p9zkG03QvwNtR3G4xTH7CZF

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dde0e20e622571cd49c616e02ce54d68_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\dde0e20e622571cd49c616e02ce54d68_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2280

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\MPK\S0000

    Filesize

    153B

    MD5

    abaff78626c00b1bc0727f7467c9c5f1

    SHA1

    fdda55c6bf8a33cfb88954e18d9aed18aab073c1

    SHA256

    cd31b86ed3e082cbf465f01ce16c7e35c67a324379f8c4190d62f6be23788d04

    SHA512

    d14e3f84f2d039cc1d614f7f21bdf2a593b71b64667fbd7a6a4820264a50ada04983a1a2769c89f3ef86c82b9835945e9cc271c7d4fed854bd0e6a8716e4aeff

  • memory/2280-0-0x0000000000400000-0x0000000000750000-memory.dmp

    Filesize

    3.3MB

  • memory/2280-1-0x0000000000320000-0x000000000036B000-memory.dmp

    Filesize

    300KB

  • memory/2280-7-0x0000000002B30000-0x0000000002D10000-memory.dmp

    Filesize

    1.9MB

  • memory/2280-6-0x0000000000760000-0x0000000000761000-memory.dmp

    Filesize

    4KB

  • memory/2280-5-0x00000000021C0000-0x00000000021C1000-memory.dmp

    Filesize

    4KB

  • memory/2280-35-0x0000000002D80000-0x0000000002D81000-memory.dmp

    Filesize

    4KB

  • memory/2280-34-0x0000000002D60000-0x0000000002D61000-memory.dmp

    Filesize

    4KB

  • memory/2280-33-0x0000000002D70000-0x0000000002D71000-memory.dmp

    Filesize

    4KB

  • memory/2280-32-0x0000000002D40000-0x0000000002D41000-memory.dmp

    Filesize

    4KB

  • memory/2280-31-0x0000000002D50000-0x0000000002D51000-memory.dmp

    Filesize

    4KB

  • memory/2280-30-0x0000000002D20000-0x0000000002D21000-memory.dmp

    Filesize

    4KB

  • memory/2280-29-0x0000000002D30000-0x0000000002D31000-memory.dmp

    Filesize

    4KB

  • memory/2280-28-0x0000000002D00000-0x0000000002D01000-memory.dmp

    Filesize

    4KB

  • memory/2280-27-0x0000000002D10000-0x0000000002D11000-memory.dmp

    Filesize

    4KB

  • memory/2280-26-0x0000000002CE0000-0x0000000002CE1000-memory.dmp

    Filesize

    4KB

  • memory/2280-25-0x0000000002CF0000-0x0000000002CF1000-memory.dmp

    Filesize

    4KB

  • memory/2280-24-0x0000000002B90000-0x0000000002B91000-memory.dmp

    Filesize

    4KB

  • memory/2280-23-0x0000000002850000-0x0000000002851000-memory.dmp

    Filesize

    4KB

  • memory/2280-22-0x00000000029E0000-0x00000000029E1000-memory.dmp

    Filesize

    4KB

  • memory/2280-21-0x00000000022A0000-0x00000000022A1000-memory.dmp

    Filesize

    4KB

  • memory/2280-20-0x0000000002490000-0x0000000002491000-memory.dmp

    Filesize

    4KB

  • memory/2280-19-0x00000000003E0000-0x00000000003E1000-memory.dmp

    Filesize

    4KB

  • memory/2280-18-0x00000000021F0000-0x00000000021F1000-memory.dmp

    Filesize

    4KB

  • memory/2280-17-0x0000000002B50000-0x0000000002B51000-memory.dmp

    Filesize

    4KB

  • memory/2280-16-0x00000000002D0000-0x00000000002D1000-memory.dmp

    Filesize

    4KB

  • memory/2280-15-0x00000000002B0000-0x00000000002B1000-memory.dmp

    Filesize

    4KB

  • memory/2280-14-0x0000000002B40000-0x0000000002B41000-memory.dmp

    Filesize

    4KB

  • memory/2280-13-0x0000000002B80000-0x0000000002B81000-memory.dmp

    Filesize

    4KB

  • memory/2280-12-0x0000000002B30000-0x0000000002B32000-memory.dmp

    Filesize

    8KB

  • memory/2280-11-0x0000000002B30000-0x0000000002B31000-memory.dmp

    Filesize

    4KB

  • memory/2280-10-0x0000000000750000-0x0000000000751000-memory.dmp

    Filesize

    4KB

  • memory/2280-9-0x0000000002B30000-0x0000000002D10000-memory.dmp

    Filesize

    1.9MB

  • memory/2280-8-0x0000000000790000-0x0000000000791000-memory.dmp

    Filesize

    4KB

  • memory/2280-4-0x00000000003F0000-0x00000000003F1000-memory.dmp

    Filesize

    4KB

  • memory/2280-3-0x00000000007B0000-0x00000000007B1000-memory.dmp

    Filesize

    4KB

  • memory/2280-2-0x0000000000780000-0x0000000000781000-memory.dmp

    Filesize

    4KB

  • memory/2280-36-0x0000000002F00000-0x0000000002F01000-memory.dmp

    Filesize

    4KB

  • memory/2280-37-0x0000000002EF0000-0x0000000002EF1000-memory.dmp

    Filesize

    4KB

  • memory/2280-39-0x0000000002F50000-0x0000000002F51000-memory.dmp

    Filesize

    4KB

  • memory/2280-47-0x0000000003D00000-0x0000000003D01000-memory.dmp

    Filesize

    4KB

  • memory/2280-46-0x0000000003CE0000-0x0000000003CE1000-memory.dmp

    Filesize

    4KB

  • memory/2280-45-0x0000000003CA0000-0x0000000003CA1000-memory.dmp

    Filesize

    4KB

  • memory/2280-44-0x0000000002F20000-0x0000000002F21000-memory.dmp

    Filesize

    4KB

  • memory/2280-43-0x0000000003CF0000-0x0000000003CF1000-memory.dmp

    Filesize

    4KB

  • memory/2280-42-0x0000000003CD0000-0x0000000003CD1000-memory.dmp

    Filesize

    4KB

  • memory/2280-41-0x0000000003CB0000-0x0000000003CB1000-memory.dmp

    Filesize

    4KB

  • memory/2280-40-0x0000000003CC0000-0x0000000003CC1000-memory.dmp

    Filesize

    4KB

  • memory/2280-38-0x0000000002F10000-0x0000000002F11000-memory.dmp

    Filesize

    4KB

  • memory/2280-49-0x0000000000400000-0x0000000000750000-memory.dmp

    Filesize

    3.3MB

  • memory/2280-55-0x0000000000400000-0x0000000000750000-memory.dmp

    Filesize

    3.3MB

  • memory/2280-56-0x0000000000400000-0x0000000000750000-memory.dmp

    Filesize

    3.3MB

  • memory/2280-60-0x0000000000400000-0x0000000000750000-memory.dmp

    Filesize

    3.3MB

  • memory/2280-54-0x00000000004AD000-0x00000000004AE000-memory.dmp

    Filesize

    4KB

  • memory/2280-53-0x0000000003DC0000-0x0000000003DC1000-memory.dmp

    Filesize

    4KB

  • memory/2280-52-0x0000000003DA0000-0x0000000003DA1000-memory.dmp

    Filesize

    4KB

  • memory/2280-51-0x0000000003D40000-0x0000000003D41000-memory.dmp

    Filesize

    4KB

  • memory/2280-50-0x0000000003D50000-0x0000000003D51000-memory.dmp

    Filesize

    4KB

  • memory/2280-61-0x0000000000320000-0x000000000036B000-memory.dmp

    Filesize

    300KB

  • memory/2280-62-0x0000000002B30000-0x0000000002D10000-memory.dmp

    Filesize

    1.9MB

  • memory/2280-64-0x0000000002B30000-0x0000000002D10000-memory.dmp

    Filesize

    1.9MB

  • memory/2280-65-0x0000000002B30000-0x0000000002B31000-memory.dmp

    Filesize

    4KB

  • memory/2280-66-0x0000000002D80000-0x0000000002D81000-memory.dmp

    Filesize

    4KB

  • memory/2280-67-0x0000000000400000-0x0000000000750000-memory.dmp

    Filesize

    3.3MB

  • memory/2280-69-0x0000000000400000-0x0000000000750000-memory.dmp

    Filesize

    3.3MB

  • memory/2280-68-0x0000000000400000-0x0000000000750000-memory.dmp

    Filesize

    3.3MB

  • memory/2280-72-0x0000000000400000-0x0000000000750000-memory.dmp

    Filesize

    3.3MB

  • memory/2280-73-0x0000000000400000-0x0000000000750000-memory.dmp

    Filesize

    3.3MB