Analysis

  • max time kernel
    150s
  • max time network
    101s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/09/2024, 05:38

General

  • Target

    ecf0561cfa4a3c3bc83a3eb29277e6ab_JaffaCakes118.exe

  • Size

    40KB

  • MD5

    ecf0561cfa4a3c3bc83a3eb29277e6ab

  • SHA1

    48b9c703b35271b65775ab915c8330dd0aefe10b

  • SHA256

    6a28f5a5a058441eeb57bb21d92d8784e84f3d3daa12f8d69ab3565e8174926b

  • SHA512

    231f1c94aef30ca619a53040342d3ed4d949dc2677fc672d998262839a5d5f5b55bea54d67d67976f9129e4f24a475fa07abd14862433609ee5de43184b27e78

  • SSDEEP

    768:BXho4ICjUkTV9+Q50BYUkEhQ3YotaiIexsgQ21LfME3Tt+:fUMV9+QiYEhboIULkMt+

Score
10/10

Malware Config

Signatures

  • Modifies firewall policy service 3 TTPs 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\ecf0561cfa4a3c3bc83a3eb29277e6ab_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ecf0561cfa4a3c3bc83a3eb29277e6ab_JaffaCakes118.exe"
    1⤵
    • Modifies firewall policy service
    • System Location Discovery: System Language Discovery
    PID:3732

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3732-0-0x0000000000510000-0x0000000000524000-memory.dmp

    Filesize

    80KB

  • memory/3732-1-0x0000000000400000-0x0000000000410000-memory.dmp

    Filesize

    64KB

  • memory/3732-2-0x0000000000510000-0x0000000000524000-memory.dmp

    Filesize

    80KB

  • memory/3732-4-0x0000000000400000-0x0000000000410000-memory.dmp

    Filesize

    64KB

  • memory/3732-13-0x0000000000400000-0x0000000000410000-memory.dmp

    Filesize

    64KB

  • memory/3732-15-0x0000000000400000-0x0000000000410000-memory.dmp

    Filesize

    64KB