Analysis
-
max time kernel
141s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
29/09/2024, 13:55
General
-
Target
feab30f126a452c3b64dda29afd89a26_JaffaCakes118.exe
-
Size
2.7MB
-
MD5
feab30f126a452c3b64dda29afd89a26
-
SHA1
7c7dd3c2998a96b0e1094869ba7a89fcccc7c56b
-
SHA256
4aa784465b856422c2e6a0249cddec07046cd65d3d384dabe823101fcb48b666
-
SHA512
0c9549faecb18792b231ecffc1580e02daedb054d1d454e7192c16f2d8c393442d9db1f20ffad1b18fea4de96d5bfd05733c0f6d6ba3c76bb5fc7087be853a33
-
SSDEEP
49152:MOn2No699iMwQvCYeUBO44RsxskmxJVAfetdZWYw7a6h2Eelx8ezpMnpJ:YNogiMw6CeBisxsSMWYwz2XlSVnn
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\feab30f126a452c3b64dda29afd89a26_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\feab30f126a452c3b64dda29afd89a26_JaffaCakes118.exe"1⤵
-
C:\ProgramData\21de604f89\6bfd576ed7.exeC:\ProgramData\21de604f89\6bfd576ed7.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5550095d13e1a9989c08cd03a06c7916e
SHA1b4836cd5c9d8d4b580d94e1d7fc33865edc39a8a
SHA25676c9fbeb416672b9f81b08aa5dc57ac035102364a1800de256fbf8f721dd0f1e
SHA51277789e33cc3736a81eec3373c505edc83b5c5da1037a9921990148f01550de24dac5b96fb6a7537b83c7d38444af93ee08158f1a95c8c2f3dfe2a1d5cb9ba735
-
Filesize
20KB
-
Filesize
8KB
-
Filesize
2.7MB
-
Filesize
2.7MB
-
Filesize
2.7MB
-
Filesize
20KB
-
Filesize
2.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
2.1MB
-
Filesize
4KB
-
Filesize
2.1MB
-
Filesize
8KB
-
Filesize
20KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
20KB
-
Filesize
2.1MB
-
Filesize
2.1MB