Analysis

  • max time kernel
    150s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-10-2024 05:27

General

  • Target

    2baea68ef184ec2ddc646d22c48862a4_JaffaCakes118.exe

  • Size

    4.4MB

  • MD5

    2baea68ef184ec2ddc646d22c48862a4

  • SHA1

    254882fdeb2da143b93f1a8ee1c6295fdfb90253

  • SHA256

    5124e8e97cb22fbbdb03700d0119beee6780ab1e2a5a545e18faac0989e8e09c

  • SHA512

    f721edc5cfa83e41d4dddc3995479ec75f1c192b9eff01b55c09a1bad33e87c80a595242efb39ac3d3a082341dab1cd7c9eed6f5aed497aadc26a30ec0ad91c3

  • SSDEEP

    98304:7F1qy1PpR+NRi1C8OrKSSgLz4oXEgOweR8sKwYKjtBmzCTkBdoJctL:7P1xR+NRi1QjSys0EUK8sJlBoCT6oJcl

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2baea68ef184ec2ddc646d22c48862a4_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\2baea68ef184ec2ddc646d22c48862a4_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:1156

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1156-0-0x0000000000401000-0x0000000000403000-memory.dmp

    Filesize

    8KB

  • memory/1156-2-0x0000000000400000-0x0000000000542000-memory.dmp

    Filesize

    1.3MB

  • memory/1156-1-0x0000000000400000-0x0000000000542000-memory.dmp

    Filesize

    1.3MB

  • memory/1156-3-0x0000000000400000-0x0000000000542000-memory.dmp

    Filesize

    1.3MB

  • memory/1156-4-0x0000000000400000-0x0000000000542000-memory.dmp

    Filesize

    1.3MB

  • memory/1156-5-0x0000000000400000-0x0000000000542000-memory.dmp

    Filesize

    1.3MB

  • memory/1156-6-0x0000000000400000-0x0000000000542000-memory.dmp

    Filesize

    1.3MB

  • memory/1156-7-0x0000000000401000-0x0000000000403000-memory.dmp

    Filesize

    8KB

  • memory/1156-10-0x0000000000400000-0x0000000000542000-memory.dmp

    Filesize

    1.3MB