Analysis
- max time kernel
135s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
29/09/2024, 03:30
General
- Target fdb716c62818bd3e7ef69b44735c7691_JaffaCakes118.exe
- Size 231KB
- Sample240929-d2vl3sybmp
- SHA256 13f5b0ec96861f56fc84ca199200457635d6e73837aef4357436a20418942d99
Malware Config
Signatures
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 3 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\fdb716c62818bd3e7ef69b44735c7691_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fdb716c62818bd3e7ef69b44735c7691_JaffaCakes118.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fdb716c62818bd3e7ef69b44735c7691_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fdb716c62818bd3e7ef69b44735c7691_JaffaCakes118.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/384-53-0x0000000000400000-0x0000000000409000-memory.dmp
memory/384-54-0x0000000000400000-0x0000000000409000-memory.dmp
memory/384-56-0x0000000000400000-0x0000000000408960-memory.dmp
memory/384-63-0x0000000000400000-0x0000000000409000-memory.dmp
memory/3368-0-0x0000000000400000-0x00000000004A0000-memory.dmp
memory/3368-15-0x0000000002370000-0x0000000002371000-memory.dmp
memory/3368-14-0x0000000002370000-0x0000000002371000-memory.dmp
memory/3368-28-0x00000000022F0000-0x00000000022F1000-memory.dmp
memory/3368-27-0x0000000002220000-0x0000000002221000-memory.dmp
memory/3368-26-0x0000000002360000-0x0000000002361000-memory.dmp
memory/3368-25-0x0000000002360000-0x0000000002361000-memory.dmp
memory/3368-24-0x0000000002360000-0x0000000002361000-memory.dmp
memory/3368-23-0x0000000002360000-0x0000000002361000-memory.dmp
memory/3368-22-0x0000000002360000-0x0000000002361000-memory.dmp
memory/3368-21-0x0000000002360000-0x0000000002361000-memory.dmp
memory/3368-20-0x0000000002360000-0x0000000002361000-memory.dmp
memory/3368-19-0x0000000002360000-0x0000000002361000-memory.dmp
memory/3368-18-0x0000000002360000-0x0000000002361000-memory.dmp
memory/3368-17-0x0000000002360000-0x0000000002361000-memory.dmp
memory/3368-16-0x0000000002360000-0x0000000002361000-memory.dmp
memory/3368-13-0x0000000002370000-0x0000000002371000-memory.dmp
memory/3368-12-0x0000000002370000-0x0000000002371000-memory.dmp
memory/3368-11-0x0000000002370000-0x0000000002371000-memory.dmp
memory/3368-10-0x0000000002370000-0x0000000002371000-memory.dmp
memory/3368-9-0x0000000002370000-0x0000000002371000-memory.dmp
memory/3368-8-0x0000000002370000-0x0000000002371000-memory.dmp
memory/3368-7-0x0000000002370000-0x0000000002371000-memory.dmp
memory/3368-6-0x0000000002370000-0x0000000002371000-memory.dmp
memory/3368-5-0x0000000002370000-0x0000000002371000-memory.dmp
memory/3368-4-0x0000000002370000-0x0000000002371000-memory.dmp
memory/3368-3-0x0000000002370000-0x0000000002371000-memory.dmp
memory/3368-2-0x0000000002360000-0x0000000002361000-memory.dmp
memory/3368-1-0x0000000002300000-0x0000000002304000-memory.dmp
memory/3368-36-0x0000000000720000-0x0000000000721000-memory.dmp
memory/3368-35-0x0000000002250000-0x0000000002251000-memory.dmp
memory/3368-34-0x0000000002290000-0x0000000002291000-memory.dmp
memory/3368-33-0x0000000002320000-0x0000000002321000-memory.dmp
memory/3368-32-0x0000000002210000-0x0000000002211000-memory.dmp
memory/3368-31-0x0000000002310000-0x0000000002311000-memory.dmp
memory/3368-40-0x00000000023C0000-0x00000000023C1000-memory.dmp
memory/3368-52-0x0000000002D90000-0x0000000002D91000-memory.dmp
memory/3368-51-0x0000000002DA0000-0x0000000002DA1000-memory.dmp
memory/3368-50-0x0000000002D60000-0x0000000002D61000-memory.dmp
memory/3368-49-0x0000000002D40000-0x0000000002D41000-memory.dmp
memory/3368-48-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/3368-47-0x00000000023B0000-0x00000000023B1000-memory.dmp
memory/3368-46-0x0000000002380000-0x0000000002381000-memory.dmp
memory/3368-45-0x0000000002390000-0x0000000002391000-memory.dmp
memory/3368-44-0x0000000002D70000-0x0000000002D71000-memory.dmp
memory/3368-43-0x0000000002D80000-0x0000000002D81000-memory.dmp
memory/3368-42-0x0000000002D50000-0x0000000002D51000-memory.dmp
memory/3368-41-0x00000000023E0000-0x00000000023E1000-memory.dmp
memory/3368-39-0x00000000023A0000-0x00000000023A1000-memory.dmp
memory/3368-38-0x0000000002360000-0x0000000002361000-memory.dmp
memory/3368-37-0x0000000002370000-0x0000000002371000-memory.dmp
memory/3368-55-0x0000000000400000-0x00000000004A0000-memory.dmp
memory/3368-58-0x0000000000400000-0x00000000004A0000-memory.dmp
memory/3460-59-0x000000007FFF0000-0x000000007FFF7000-memory.dmp
memory/3460-60-0x000000007FFD0000-0x000000007FFD1000-memory.dmp