Analysis

  • max time kernel
    121s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    01/10/2024, 02:20

General

  • Target

    0404b59f5ba27c50099600fa16daf51d_JaffaCakes118.exe

  • Size

    432KB

  • MD5

    0404b59f5ba27c50099600fa16daf51d

  • SHA1

    11d5fc770ac71d777fc41df9354fd19986f898ce

  • SHA256

    67c629c77f40bcccaec93f318a3738ecab4df11b9fdd69ed2ad77ab0dc29f102

  • SHA512

    569c2d6faff0c14111fe75552e12adc122763360cf6369fd02df3355691cbc0dec91d7db65f9528d522a2b54e62b59803abf99d88e30142e456dcc7a88a42c53

  • SSDEEP

    6144:n+Hhn0clK7bI5n9AX2k9LIxHn83YMLCfvwQ7oi+yn9vMv+vJVVr2wmK7Vp12rR4Q:nbc0i9Amk9LIu3ZZU5n++hv2BKJ2FYM

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\0404b59f5ba27c50099600fa16daf51d_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0404b59f5ba27c50099600fa16daf51d_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:2592

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2592-0-0x00000000001D0000-0x00000000001D1000-memory.dmp

          Filesize

          4KB

        • memory/2592-1-0x0000000000280000-0x00000000002BC000-memory.dmp

          Filesize

          240KB

        • memory/2592-5-0x0000000075CD1000-0x0000000075CD2000-memory.dmp

          Filesize

          4KB

        • memory/2592-4-0x0000000077330000-0x0000000077331000-memory.dmp

          Filesize

          4KB

        • memory/2592-3-0x0000000001D10000-0x0000000001D20000-memory.dmp

          Filesize

          64KB

        • memory/2592-2-0x0000000001D80000-0x0000000001D90000-memory.dmp

          Filesize

          64KB

        • memory/2592-6-0x0000000075CC0000-0x0000000075DD0000-memory.dmp

          Filesize

          1.1MB

        • memory/2592-7-0x0000000000400000-0x0000000000465000-memory.dmp

          Filesize

          404KB

        • memory/2592-8-0x0000000000280000-0x00000000002BC000-memory.dmp

          Filesize

          240KB

        • memory/2592-9-0x0000000075CC0000-0x0000000075DD0000-memory.dmp

          Filesize

          1.1MB