Analysis
-
max time kernel
96s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
03/10/2024, 21:36
General
-
Target
1096650d689670e86fc3c91c9ad1c7e4_JaffaCakes118.exe
-
Size
97KB
-
MD5
1096650d689670e86fc3c91c9ad1c7e4
-
SHA1
37befbaa7fea9a2a98da041c458eb32783c0a75e
-
SHA256
d2c2a3a97602dce6d7bfdf2281370b99aa1db01d2ef2987e864ec9dc95952316
-
SHA512
c792ad64bbf12d6d2b2b1ab22705d94518ee2ae3dd7805c1081de3d3aa80728922d22098d6ff318d16c30135d1d9a1d0783fc029069f996da0f86428903c7790
-
SSDEEP
1536:Ru4EQalMK/ewGnh0mJElZxugAS0fH8epkUfurVF9Jn5R9m03Ly/WMVF48IXL744I:RNyah0mJgh/0fkrVFw0by/rVFiXvO
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
-
Loads dropped DLL 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1096650d689670e86fc3c91c9ad1c7e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1096650d689670e86fc3c91c9ad1c7e4_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
MD58b17760dc38aaf5e26c632c710e9e464
SHA185b5904f68769d9fc9ea0b1fda810c047480f6d9
SHA256dc6eb22d35a1ae0a8cc8d39903eff9f5b3cf392e080524dc154263c210a03b2a
SHA512f530018826ba12a70ec84cb833f35f5ed2fc4f779196df94313915811be5a447270d16e6e0e97df71390b73c47b3b4214e9ec5d47f3613f85fbb5fa33a109a49
-
Filesize
112KB
-
Filesize
112KB
-
Filesize
112KB
-
Filesize
112KB
-
Filesize
112KB
-
Filesize
112KB
-
Filesize
112KB
-
Filesize
112KB
-
Filesize
112KB
-
Filesize
112KB
-
Filesize
112KB