Analysis

  • max time kernel
    121s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    09/10/2024, 06:44

General

  • Target

    2ca9088e01943fc02a966515f05c4c6b_JaffaCakes118.exe

  • Size

    302KB

  • MD5

    2ca9088e01943fc02a966515f05c4c6b

  • SHA1

    c8465073ad6c61abe3b1a278b93bb659235a99ee

  • SHA256

    054c2f0af10be508d67c23fd98cdf4ad9b832be5c8b3863aee6898e17c2dc6c9

  • SHA512

    012e78cfa75490d237f1a225a77bcd8de03b55ca6c80c67eb701b50ca3b0d1c66418e30efb5b5a7e0b7c2d13171922a8953135badee38187a231b3298717cf6e

  • SSDEEP

    6144:ArV76Y0JQBkQRl7174NpNUM+UHs+eeerIi9BJeN9CyDEOwklK:ArV763yRl1uqM+gs+GIgBJenFD1pK

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2ca9088e01943fc02a966515f05c4c6b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\2ca9088e01943fc02a966515f05c4c6b_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: GetForegroundWindowSpam
    PID:2444

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\Tsu315FC3C0.dll

    Filesize

    269KB

    MD5

    af7ce801c8471c5cd19b366333c153c4

    SHA1

    4267749d020a362edbd25434ad65f98b073581f1

    SHA256

    cf7e00ba429bc9f27ccfacc49ae367054f40ada6cede9f513cc29a24e88bf49e

    SHA512

    88655bd940e9b540c4df551fe68135793eceed03f94389b0654637a18b252bf4d3ef73b0c49548b5fa6ba2cf6d9aff79335c4ebcc0b668e008bcc62c40d2a73c

  • \Users\Admin\AppData\Local\Temp\{3D481A47-C779-4153-A3B8-8F5BE6AB38B1}\Custom.dll

    Filesize

    63KB

    MD5

    6380d3c7277930f68838bf6d87372b29

    SHA1

    929af452a82b0a912298f9edf5a4ff99365643fb

    SHA256

    3a18f7e977e3c3d6ae431ea9e3a668a109bc6ecaa712cc776f9b11ba8b3bda27

    SHA512

    987024241b0cc154ff06f006352c18500490f1266a5c4b9e9d9a3ebe2fe0bfae5a95c4d2e7fe39b4eb32634003783b1ec4c499111cb43c73018d66f0d2d2a4c1

  • \Users\Admin\AppData\Local\Temp\{3D481A47-C779-4153-A3B8-8F5BE6AB38B1}\_Setup.dll

    Filesize

    160KB

    MD5

    59402a7e186716680025f44c0901e227

    SHA1

    1abfe8ebcba6b6b655a4aa0196039c670bdaeb3a

    SHA256

    f1d3cb9fdd48adaaf8019669ed9f32538507af669e1510d9d9af7bb74efa3135

    SHA512

    a420d69f25ee95a342a213ef6b89f53f2207e0c25f60fe0b566327008f81e89caed6ed0e948834c90739ca2f72f926411afb7097b559e9e8ab4c3f2499522bb3