Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    25/09/2024, 23:23

General

  • Target

    f70f42beced10659703660d0355ec13f_JaffaCakes118.exe

  • Size

    219KB

  • MD5

    f70f42beced10659703660d0355ec13f

  • SHA1

    bdd5ddec0f95e756f7c9241d96be9c611cab79ad

  • SHA256

    1108afa37805a93a55c4ea27898ea85f5f1a34503c0d46fe36dd7912ca7d5b0d

  • SHA512

    f9d9f7ffcde4f5a7aa240e7956b67e8b9b8d01e6230bffbb78bc92cff32767f9ead76e4ded13d2d428164ba029b4456c328cd4f82952dcc7bd616e8e07d8178c

  • SSDEEP

    6144:bMcRJBZBRbkUUrNbzw1HPQXCfae6WmdKm:oM3jRbRZ1vQyfF6WmdKm

Score
6/10

Malware Config

Signatures

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\f70f42beced10659703660d0355ec13f_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f70f42beced10659703660d0355ec13f_JaffaCakes118.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    PID:1232

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1232-0-0x0000000000020000-0x0000000000021000-memory.dmp

          Filesize

          4KB

        • memory/1232-1-0x0000000000030000-0x0000000000031000-memory.dmp

          Filesize

          4KB

        • memory/1232-2-0x00000000000C0000-0x00000000000C1000-memory.dmp

          Filesize

          4KB

        • memory/1232-3-0x00000000000D0000-0x00000000000D1000-memory.dmp

          Filesize

          4KB

        • memory/1232-4-0x00000000000E0000-0x0000000000100000-memory.dmp

          Filesize

          128KB

        • memory/1232-9-0x00000000000E0000-0x0000000000100000-memory.dmp

          Filesize

          128KB

        • memory/1232-5-0x0000000000210000-0x000000000023F000-memory.dmp

          Filesize

          188KB

        • memory/1232-17-0x00000000000E0000-0x0000000000100000-memory.dmp

          Filesize

          128KB