Analysis
-
max time kernel
95s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
30/09/2024, 23:19
General
-
Target
0397c02b40d8412e58cf7f692ed2df03_JaffaCakes118.exe
-
Size
862KB
-
MD5
0397c02b40d8412e58cf7f692ed2df03
-
SHA1
3101b93fc799d00789e35c6d4deff255ec8de15e
-
SHA256
673c446d71c00b72c283cbc5703bbceb88df7255db9ea564393e83cfc40fb3fe
-
SHA512
773f6ed3c72d45b6933433a4c5bc42fb52008c676ec8bbf3fcc1829294f88a3e1b2ab40ae991e72711bdf09af8d0bdf943f1d10841a8d8da7de9cd8af83da683
-
SSDEEP
24576:2xqT31T6WE6I5jKqosOm+bDNA3K6NYEai7hySZGo:x6WE6IN95+bDNA3K6Gfpo
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of FindShellTrayWindow 16 IoCs
-
Suspicious use of SendNotifyMessage 16 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0397c02b40d8412e58cf7f692ed2df03_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0397c02b40d8412e58cf7f692ed2df03_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage