Analysis

  • max time kernel
    149s
  • max time network
    116s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/09/2024, 09:34

General

  • Target

    e22e4582ca0520fc2dae75e26b35ce0b_JaffaCakes118.exe

  • Size

    14.2MB

  • MD5

    e22e4582ca0520fc2dae75e26b35ce0b

  • SHA1

    ea4ae8aa9a3462164f353258b5dfdf56a27a793f

  • SHA256

    27228c21c361bb848fb33435b9a8c8f32e48e284f5919dec1a34c999bdc54582

  • SHA512

    bb0a3af630dd49c27a1882d367ba2a9e7348c7d69dc2d1e830297341fff67f5f9fc7a63e6b305a997cc2e02ee379f47a5af834430628d47be7b992c1c11ca176

  • SSDEEP

    49152:YJLc1kqIk5yFDgCRX6H4FPT0HB+ZGB/p43O7w9VFZnpu+2RJli7VS5C:Ya1p55YfRqH1xtUFNpuBRJli7VS5C

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e22e4582ca0520fc2dae75e26b35ce0b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e22e4582ca0520fc2dae75e26b35ce0b_JaffaCakes118.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:3296

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\Tasks\AntispywareBot Scheduled Scan.job

    Filesize

    610B

    MD5

    041b8405c7ae860386be398df1bbd99b

    SHA1

    76a4bf2623c43b49921469fe8638ce83d254fd90

    SHA256

    5aae1f72c4379071e55d8bb3292157dbeae6f120023981da405bb399d4b85ea5

    SHA512

    174031a4c67c5e3eba71784b98914ad0c3b9a6d38881a5497f3263fe7f3bac3b5205896234c52aa2b22d6c4ec17ac7e3818f145016ef2246d33d56f31498db3f