Analysis
-
max time kernel
97s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
14/09/2024, 07:27 UTC
Static task
static1
Behavioral task
behavioral1
Sample
dfbce5a8048a1645244a1558480951f5_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
dfbce5a8048a1645244a1558480951f5_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
dfbce5a8048a1645244a1558480951f5_JaffaCakes118.exe
-
Size
111KB
-
MD5
dfbce5a8048a1645244a1558480951f5
-
SHA1
d2766709af450a32590377a92265304c28ab8319
-
SHA256
fcc6c326ba864856a4489ca4133eddfa43a0e60d91acbc0dfe68dd651560dc5f
-
SHA512
81d2ce8caf9c07006ff3d516f9d0a9ebce40c89d8252e93a99db95bd9ba07d9ce1e4516ae55809e913c8a3f731531841446c3726a9c6cda5192735125c7ac3c5
-
SSDEEP
3072:9std5vQR+gyYlUUzMHJso0JFIxnOdjF8NIbcF+:9sJc+5FUjTIpOr3AE
Malware Config
Signatures
-
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\ST5UNST.000 dfbce5a8048a1645244a1558480951f5_JaffaCakes118.exe File opened for modification C:\Windows\ST5UNST.000 dfbce5a8048a1645244a1558480951f5_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dfbce5a8048a1645244a1558480951f5_JaffaCakes118.exe
Processes
Network
-
Remote address:8.8.8.8:53Request149.220.183.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request149.220.183.52.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request149.220.183.52.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request172.214.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request68.32.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request97.17.167.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request183.59.114.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request15.164.165.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request172.210.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request81.144.22.2.in-addr.arpaIN PTRResponse81.144.22.2.in-addr.arpaIN PTRa2-22-144-81deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request13.227.111.52.in-addr.arpaIN PTRResponse
-
219 B 147 B 3 1
DNS Request
149.220.183.52.in-addr.arpa
DNS Request
149.220.183.52.in-addr.arpa
DNS Request
149.220.183.52.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.214.232.199.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
68.32.126.40.in-addr.arpa
-
71 B 145 B 1 1
DNS Request
97.17.167.52.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
183.59.114.20.in-addr.arpa
-
72 B 146 B 1 1
DNS Request
15.164.165.52.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.210.232.199.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
81.144.22.2.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
13.227.111.52.in-addr.arpa