Analysis
-
max time kernel
93s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
14-09-2024 04:03
Static task
static1
Behavioral task
behavioral1
Sample
df747f4fcc63706afc339f6f8d42b2b0_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
df747f4fcc63706afc339f6f8d42b2b0_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
df747f4fcc63706afc339f6f8d42b2b0_JaffaCakes118.exe
-
Size
152KB
-
MD5
df747f4fcc63706afc339f6f8d42b2b0
-
SHA1
6b6246095dcf19bd58b408790fb8c088e76088ed
-
SHA256
6570da7c08654f5291563ddc64de9f9f2289fe1eb2fc47618ec02330c40b67e4
-
SHA512
d1a46bf611e622b04fe70291b34775df535af0be983cefd6c8f703bac17dd300245c1bc91d4e019ea28aab702b6e57a8e986dea948b777fd17f6d3d6cc9a75ca
-
SSDEEP
3072:PvkHeR+EFZcZbE/1SEQAoYXNIlfyZsdVPRtw7O7S:PcHeR+Y241SEYoIlllh2
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\s.exe df747f4fcc63706afc339f6f8d42b2b0_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language df747f4fcc63706afc339f6f8d42b2b0_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4936 df747f4fcc63706afc339f6f8d42b2b0_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\df747f4fcc63706afc339f6f8d42b2b0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\df747f4fcc63706afc339f6f8d42b2b0_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4936
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
MD538e8bf56ed1de5b695c6f473edee04fb
SHA1acbca3446d021b64bd0209d9e86913a519667705
SHA256615f316a431461da6dd7e265471078a4133dbf4afbd9e302f73eedca47cf59e1
SHA51252bf7b49dd96256265596dbf49ae980cbd6bcaf8806147fc0d096dc1b32ad091715c9fcf2e5a00b064ae8872823ea528565e55505b2d78ced0080527b6a6b166