Analysis
-
max time kernel
140s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
17-09-2024 20:08
General
-
Target
e79d301be6f30a698fdc2c122ee97c05_JaffaCakes118.exe
-
Size
2.4MB
-
MD5
e79d301be6f30a698fdc2c122ee97c05
-
SHA1
584d79744e07657e1d211973c30247fee37d60d0
-
SHA256
f248f53e4c9e2d0d1666734da19e542b5ce0b523760fa7488cbf89ab4df45b36
-
SHA512
b4fa25c8a7733f970fc60c050a50481d77f087ac0fa4242f53059215955b8e04d200fb8a445b4b6c126450832ba4e1b1f06c66eb0c371111277b7c4379a88c87
-
SSDEEP
24576:57j1mpKlFqDgxRJeW9pcu+BkSHD1wejQMUXWNca7E0JuPf0DGlmil9NCHdrc01UR:5DlFJHgmSxwzCca7UPcDOz8drnP
Score
10/10
Malware Config
Extracted
Family
latentbot
C2
costarncosta.zapto.org
Signatures
-
LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e79d301be6f30a698fdc2c122ee97c05_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e79d301be6f30a698fdc2c122ee97c05_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
2.5MB