Analysis
-
max time kernel
94s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
28/09/2024, 15:23
General
-
Target
fc961c1f4920935a52c1590a95e05627_JaffaCakes118.exe
-
Size
591KB
-
MD5
fc961c1f4920935a52c1590a95e05627
-
SHA1
7e2102e0c0ff99f9373813ea3df934bb47a1128e
-
SHA256
f9cd68ffdfa6ee0590d3c024f2101408c85bac3fd53ff75d291a22f9187e40c1
-
SHA512
a416561fc9218529edae35430919886f5f41cca68d4787f88368f2946d040d1a987cda3e6ba574e4ca94ec5e883123aa9cb19d0346966e7d0a61f538ae32d18c
-
SSDEEP
12288:6rGer82ED+oZduCBMZYCZz+IF3Z4mxx4x8+l6ZFkdAcbb:6rGeY+Ydu4fMCIQmX2SkdAc
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Drops file in System32 directory 3 IoCs
-
Drops file in Windows directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fc961c1f4920935a52c1590a95e05627_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fc961c1f4920935a52c1590a95e05627_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\Delete.bat2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\svchostvsC:\Windows\SysWOW64\svchostvs1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
214B
MD5d9ddbb63b100ac854e3e7c9861e6132a
SHA19be7aa8b66b6a61f8b3c1ee8ccbe936ba841c200
SHA25681fc3ed8cb51480475d09515f93d9cf40bcffd0ecfacc4cb6cbc001c8f47c201
SHA512b3d0f782b85763ea1123955e8fc5183e7b44f92c48b9b39c8ed9afa9333c94a38ea41180dca0192b9a7465fcc3830dd7446d466dcd1dda8a5b170a55e21c6cd0
-
Filesize
591KB
MD5fc961c1f4920935a52c1590a95e05627
SHA17e2102e0c0ff99f9373813ea3df934bb47a1128e
SHA256f9cd68ffdfa6ee0590d3c024f2101408c85bac3fd53ff75d291a22f9187e40c1
SHA512a416561fc9218529edae35430919886f5f41cca68d4787f88368f2946d040d1a987cda3e6ba574e4ca94ec5e883123aa9cb19d0346966e7d0a61f538ae32d18c
-
Filesize
1.3MB
-
Filesize
336KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.3MB
-
Filesize
336KB
-
Filesize
1.3MB