Analysis

  • max time kernel
    150s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    02/10/2024, 09:55

General

  • Target

    0a166fa7b9aad0a2db69f52f52036ac9_JaffaCakes118.exe

  • Size

    29KB

  • MD5

    0a166fa7b9aad0a2db69f52f52036ac9

  • SHA1

    3a60d71c13be04685c14470c5e51e2ed744c0399

  • SHA256

    b75184bbac6850b6ed3979762428c333601bab2a1abbd6e4a8ce4adbec762ad1

  • SHA512

    b723310ef98b2ca263ce1c49ce78c82c5e170a639ad9bfe08d00118d0a5e94164a5c70a7424f1038e45f682913e6ee27712014e0e15b861d6f209df3ab75bdd9

  • SSDEEP

    768:xsXruzqN0qwZX/CLXnUHYCDuHXV7OzCh+Vf67CYczkBxadi:/qNGZQ3qlY4wQi7CfzNdi

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0a166fa7b9aad0a2db69f52f52036ac9_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0a166fa7b9aad0a2db69f52f52036ac9_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1476

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\wdwf0a166fa7b9aad0a2db69f52f52036ac9_JaffaCakes118.dll

    Filesize

    47KB

    MD5

    47a7aa545a408da28a2fbe2d94d8991f

    SHA1

    8a8d82c396e287513179b65170152c79d2f2da3a

    SHA256

    12b54ddf13e3f3aa330ffa93032994877c894f3b1311a139b3ad352233eda233

    SHA512

    64dd7bf51091b7ecd262b335a81786ecaea0a45b6a4d993b663c4ed38a92667d9025dca83cf41a92f994624ca6b45ea38db3c0858f502b03870a5a169bcbcff5

  • memory/1476-3-0x00000000003D0000-0x00000000003E1000-memory.dmp

    Filesize

    68KB

  • memory/1476-5-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/1476-6-0x00000000003D0000-0x00000000003E1000-memory.dmp

    Filesize

    68KB