Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
03-10-2024 22:00
General
-
Target
10a9bc20969e787b091edfa8d5ca370b_JaffaCakes118.exe
-
Size
56KB
-
MD5
10a9bc20969e787b091edfa8d5ca370b
-
SHA1
5af080bb18cea53f61a57dd8cdf1039a126a879a
-
SHA256
da2ca3aef2fbc302ff61e6cac1a015d20f24d4277bf5e8a91542e13709466ff2
-
SHA512
46146e1a29c1b9bdd373fee8cfb0fb51d7251a65191fb109018a44b02fe81d48564dec378b6576b07b05cea61f837c90548cbcc59ef51d1458914b2cc5bc9619
-
SSDEEP
1536:arY2icG+m5kG08XCKkziH8lnz3c0uuG3o:ar0cGpyz8ozmi40fGY
Score
10/10
Malware Config
Extracted
Family
latentbot
C2
dasubertang2.zapto.org
Signatures
-
LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\10a9bc20969e787b091edfa8d5ca370b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\10a9bc20969e787b091edfa8d5ca370b_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB