Analysis

  • max time kernel
    93s
  • max time network
    137s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-09-2024 06:59

General

  • Target

    eacebed55ebdd6edffa81f8b82295fbc_JaffaCakes118.exe

  • Size

    107KB

  • MD5

    eacebed55ebdd6edffa81f8b82295fbc

  • SHA1

    4a49de09af89939a2cca24b882da2cec805dd642

  • SHA256

    38b74663abec1e88ce76d9a68b34c7bf80479bdb11a8dd29b2e1574e2aa19251

  • SHA512

    964f9ea42a6f04577b2c07b0e3673930ec15dc3ddd79a648192748dac3fc23f412b6587d7341244eab9319442c429846dbe67db340e1195f81dd901842678f10

  • SSDEEP

    1536:sHsaGa2gvKFciDLnqfFDeFMP7KjQrJUxwghAm0lAYF09C+3ZHqd7BT6E40lpFW5:sMaGpMPiqFDS/QiwztHL+pK1pFW5A

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eacebed55ebdd6edffa81f8b82295fbc_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\eacebed55ebdd6edffa81f8b82295fbc_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:3820
    • C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      2⤵
        PID:3800

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3820-0-0x0000000000400000-0x0000000000424000-memory.dmp

      Filesize

      144KB

    • memory/3820-1-0x00000000006E0000-0x00000000006E1000-memory.dmp

      Filesize

      4KB

    • memory/3820-2-0x0000000000400000-0x0000000000414000-memory.dmp

      Filesize

      80KB

    • memory/3820-3-0x0000000000400000-0x0000000000414000-memory.dmp

      Filesize

      80KB

    • memory/3820-4-0x0000000000420000-0x000000000042E000-memory.dmp

      Filesize

      56KB