Analysis
-
max time kernel
16s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
29/09/2024, 02:23
General
-
Target
fd9d21f051d67261ca3b879c3059b6df_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
fd9d21f051d67261ca3b879c3059b6df
-
SHA1
56d1b675ea7b098b8f440edd25c14e606b02d852
-
SHA256
d5bea1885629d33036451de0562f84ef33930255332c0bc2de954cece52eacd5
-
SHA512
74bad4ff888c8fa4cd8914d9fdd2d6d6729c33aa4dad0d391bd6c5f670ed4aa35d404c03722f442d8e465716e16c662d88162b8125c122dfd7a8fa827e6925c7
-
SSDEEP
49152:FVg6QO8ikl0Fh2U2sUeqzJidHFhdmX7NREKrB:FbOikl0Z2Nzc3hEBRlB
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 11 IoCs
-
Suspicious use of SendNotifyMessage 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fd9d21f051d67261ca3b879c3059b6df_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fd9d21f051d67261ca3b879c3059b6df_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
6.8MB