Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
25/09/2024, 07:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe
-
Size
368KB
-
MD5
f5741da1705bd37cc9392426fe4b41cf
-
SHA1
1a6352af9b9a97725f6663661d01d49216a949b2
-
SHA256
49225cd220338ee9f2bd84bb97a43fb17ace4641f97d26ea0a283f16e17f59d9
-
SHA512
157570926e85e9bb25dc2ead01b63c627dde2a78b0e875ccaaa6732c3b7c5fb9f0bd4250dc5b7df923b96811e235e840d697eec17770ea0b64b5a5db3505db38
-
SSDEEP
6144:sD82aqVCjTCvawYzru2FI0B2Wn3OmBLEeg12puzF3umh3LW0ZZ47Jec10bN72:sDHaqVRSJaEOmxEe82pMLLtZGN12NC
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe 1700 f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f5741da1705bd37cc9392426fe4b41cf_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1700
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
63B
MD5d48b0fb60d028b2ee44a33cbdd2bc26e
SHA114448dab97e534f7e7064d16be3f7761c2378f12
SHA25694eb685323f488cbe63cabce2a1b9093735c4998fc7144abcaeceb5949194aa2
SHA512a60ebe56c3ede1cf94f8b47e4427c47a0f64ed0d863b94572fa49a3c2470785cfcf87224d21eba41d96a393759de5d25a8115ad56f4b55da9f93b4b5e116767e