Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18-09-2024 19:58
Static task
static1
Behavioral task
behavioral1
Sample
e9dfb372d5ec35d80c5e411a1b6a07b0_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e9dfb372d5ec35d80c5e411a1b6a07b0_JaffaCakes118.exe
Resource
win10v2004-20240910-en
General
-
Target
e9dfb372d5ec35d80c5e411a1b6a07b0_JaffaCakes118.exe
-
Size
471KB
-
MD5
e9dfb372d5ec35d80c5e411a1b6a07b0
-
SHA1
d28a53da10e622eae8ca0404110f968b420f62f9
-
SHA256
45bdd4cf1504c05e009455cdf1a227534a656c7e7ec3d20d0b93371f1c16cfac
-
SHA512
f48332063ee77d55e842b19f40f53e88d5619d854a1579f0203c77c64fbdc59b995e56f3883781f598113e184e33dc17df7ad0183ba489b0e8aba580e4015a91
-
SSDEEP
6144:dPfyhs5G32Xu7YtMrbm2MrJj6NzoBcZSxYxdYor6tLhD0pJG7zE/gEFmea5kimZB:o2yYt49NzoBcZBEoGtFzKm/dh4gW9SA
Malware Config
Signatures
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e9dfb372d5ec35d80c5e411a1b6a07b0_JaffaCakes118.lnk e9dfb372d5ec35d80c5e411a1b6a07b0_JaffaCakes118.exe -
Loads dropped DLL 1 IoCs
pid Process 1644 e9dfb372d5ec35d80c5e411a1b6a07b0_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e9dfb372d5ec35d80c5e411a1b6a07b0_JaffaCakes118.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
\ProgramData\{ba45f236-2bd9-7da1-ba45-5f2362bdc8d8}\e9dfb372d5ec35d80c5e411a1b6a07b0_JaffaCakes118.exe
Filesize471KB
MD5e9dfb372d5ec35d80c5e411a1b6a07b0
SHA1d28a53da10e622eae8ca0404110f968b420f62f9
SHA25645bdd4cf1504c05e009455cdf1a227534a656c7e7ec3d20d0b93371f1c16cfac
SHA512f48332063ee77d55e842b19f40f53e88d5619d854a1579f0203c77c64fbdc59b995e56f3883781f598113e184e33dc17df7ad0183ba489b0e8aba580e4015a91