Analysis
-
max time kernel
144s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28/09/2024, 06:37
Static task
static1
Behavioral task
behavioral1
Sample
fbb521e9023c2bf00e7be8cbbe43020c_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fbb521e9023c2bf00e7be8cbbe43020c_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
fbb521e9023c2bf00e7be8cbbe43020c_JaffaCakes118.exe
-
Size
613KB
-
MD5
fbb521e9023c2bf00e7be8cbbe43020c
-
SHA1
530cc488371b04641de5d61b8c9205b504e5734b
-
SHA256
5b273e01c72efdc08ce80ee64918346d3a12dfc614182c8e4b4ff5ee792fb125
-
SHA512
cb45e46d1247d61d2b7b75b9d1ecacdafa61f85cd00143b2bfcda76546b4a05569046a7992dcb69eb1e81346f9f2b6a6befcef42294bf742cdc73d046740fdb0
-
SSDEEP
12288:Fp3vcZ1KJJFZva+980b7JY262uyq5UirkbBDS81XGf8X4p32:FpfcZ1aJFZva+980nJY2o5UirktS81XH
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fbb521e9023c2bf00e7be8cbbe43020c_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2228 fbb521e9023c2bf00e7be8cbbe43020c_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2228 fbb521e9023c2bf00e7be8cbbe43020c_JaffaCakes118.exe 2228 fbb521e9023c2bf00e7be8cbbe43020c_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fbb521e9023c2bf00e7be8cbbe43020c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fbb521e9023c2bf00e7be8cbbe43020c_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2228
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD5fc442da30de4ec1762ced3f70245001e
SHA1c00decd1e0ed47bdf0ec0f283fb70ba65df2cda9
SHA2567828c350a92add204a68506d984955323f2bba7dd8734bdeaf490d022d68cd7a
SHA5120fc85f3c64be45353beef86bf49f109b6ea8ebdc8b34051e255db76b64c49481460f34ed1a8384dff7439c2c9d3fb2ae3b78299cb37e1786372a2a42474bc169