Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/09/2024, 06:54

General

  • Target

    000f24148d3b8623225822f54ea4bda9_JaffaCakes118.exe

  • Size

    95KB

  • MD5

    000f24148d3b8623225822f54ea4bda9

  • SHA1

    b56812c0ad63a8ae2ca8151ed24f4b2c8ae462e0

  • SHA256

    71452d2c427437411a988aa9f5ab17dc10f4cbf85dc909eb457fecfe732ca93c

  • SHA512

    c74279a7c26f967deb867e2ce922f0bf2b7040871f5656631a16e0d024f48853e6f009dd72b51d57a1692193e1eb30bd05b944ad982b24199effd044de613507

  • SSDEEP

    1536:Bv0vQ1vMce/NgWOT7UaXNg0P79U2fZJizr8k8Di7ZzALnunSSC+zXVI1:Bv0I1EcRWgt9DJizokZ7WnunXzXc

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\000f24148d3b8623225822f54ea4bda9_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\000f24148d3b8623225822f54ea4bda9_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3624
    • C:\Users\Admin\AppData\Local\Temp\000f24148d3b8623225822f54ea4bda9_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\000f24148d3b8623225822f54ea4bda9_JaffaCakes118.exe
      2⤵
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:3432

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3432-51594-0x0000000003A50000-0x0000000003A51000-memory.dmp

    Filesize

    4KB

  • memory/3432-51595-0x0000000003A50000-0x0000000003A51000-memory.dmp

    Filesize

    4KB

  • memory/3432-51593-0x0000000000400000-0x000000000043D000-memory.dmp

    Filesize

    244KB

  • memory/3432-51596-0x0000000003B40000-0x0000000003B41000-memory.dmp

    Filesize

    4KB

  • memory/3432-51597-0x0000000003B40000-0x0000000003B41000-memory.dmp

    Filesize

    4KB

  • memory/3432-51599-0x0000000000400000-0x000000000043D000-memory.dmp

    Filesize

    244KB

  • memory/3432-51600-0x0000000003A50000-0x0000000003A51000-memory.dmp

    Filesize

    4KB

  • memory/3432-51601-0x0000000003B40000-0x0000000003B41000-memory.dmp

    Filesize

    4KB

  • memory/3432-51602-0x0000000003B40000-0x0000000003B41000-memory.dmp

    Filesize

    4KB

  • memory/3624-0-0x0000000000400000-0x000000000043D000-memory.dmp

    Filesize

    244KB

  • memory/3624-2896-0x0000000000400000-0x000000000043D000-memory.dmp

    Filesize

    244KB