Analysis
-
max time kernel
140s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
29-09-2024 04:35
General
-
Target
fdcf1647e968a9d7de38ce5dc4e3efa4_JaffaCakes118.exe
-
Size
5.0MB
-
MD5
fdcf1647e968a9d7de38ce5dc4e3efa4
-
SHA1
1ed5e4399abb38b3af9b2fa78f1d436293d908cf
-
SHA256
83f957f12c1f215e5823f2654817dfffe2c2b4e6ae15e501a471c6d01e732abf
-
SHA512
f0e727710aeb3dc9376b87ea3f8cd6911a87d69dac0878994068d2de0c2e15b385677df1ffd7f1ac32cd180a5fe97966da17b07eab9b1260758243c7c879c766
-
SSDEEP
98304:D22YeKFojewsUezO5RCA1dJg1VL0rmNKQpMD5RVxIZsw:y1eKFU9d11rmNVpMD5RHYT
Malware Config
Signatures
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Maps connected drives based on registry 3 TTPs 3 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of SetWindowsHookEx 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fdcf1647e968a9d7de38ce5dc4e3efa4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fdcf1647e968a9d7de38ce5dc4e3efa4_JaffaCakes118.exe"1⤵
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
5.1MB
-
Filesize
5.1MB