Analysis
-
max time kernel
93s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
03/10/2024, 17:46
General
-
Target
0fece6d7750e618fc86d408a02d8b86e_JaffaCakes118.exe
-
Size
144KB
-
MD5
0fece6d7750e618fc86d408a02d8b86e
-
SHA1
01ea5fb3b32db0da0ad0cae48a1ca95a673b3db7
-
SHA256
1c991cca81e68ada35eb28dfec2c99bd426197fba047f30985788873efef03b8
-
SHA512
2dbc7909075487368bcc4e13050397e23eeeba497878e5cbf76a496a7c4863d2d80b5d7f79e3499c8d573f3df7519f8b03f52230487ae64d3cb98d93fb9d74b9
-
SSDEEP
1536:9BI5pwLfZshrCduppMOwIqEV1pBvVvM7qczGG/sWjcdk5a+k3h5khMqEEajb4:XlV4UWKERi7AkY+k3h5YnEEaj8
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0fece6d7750e618fc86d408a02d8b86e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0fece6d7750e618fc86d408a02d8b86e_JaffaCakes118.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx