Analysis
-
max time kernel
120s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
12-10-2024 16:31
General
-
Target
3b01f0db9c9e9476dd4b225a64fec053_JaffaCakes118.exe
-
Size
197KB
-
MD5
3b01f0db9c9e9476dd4b225a64fec053
-
SHA1
55af6d2a509fcdaef3441e6307eee3164e31f643
-
SHA256
9e30f9a97bd295ad276b607f2cb70da2197934913c6b88144679accf1ba64a48
-
SHA512
dd1ee5b67e1f7a7190de271608c79ee0f3f0b629451d33d58ac3c19ecc6218f16cc615dc4b51e87c3f61d714582d1d12a2da50f2a0e8a93dd47fcd873e1df5c8
-
SSDEEP
3072:O4eYZ4+1JXJJyjf6uZxNGrLY1swfOZFNFuv1shOZFl:75O81rkSwfkFNFKShkFl
Malware Config
Signatures
-
Loads dropped DLL 40 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3b01f0db9c9e9476dd4b225a64fec053_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3b01f0db9c9e9476dd4b225a64fec053_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
32KB
MD5e990392f704e9a61afe7257bb99efa13
SHA13d14c9b0b92ffc4249456df43bb015d346ed7277
SHA2561891cfbdfaf2eda0c8c43294a59b62b95483bf7403e807e150065f548022906d
SHA512d5259d188868b8454a872e3bcce031f5fe69febfa4a48190a817b47c0bece732b63aeabace88120660efef42e445d781fd98ad99f31d04de1bb0478e6de34b33
-
Filesize
3KB
MD58614c450637267afacad1645e23ba24a
SHA1e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2
SHA2560fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758
SHA512af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b
-
Filesize
20KB
MD550fdadda3e993688401f6f1108fabdb4
SHA104a9ae55d0fb726be49809582cea41d75bf22a9a
SHA2566d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6
SHA512e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8
-
Filesize
11KB
MD500a0194c20ee912257df53bfe258ee4a
SHA1d7b4e319bc5119024690dc8230b9cc919b1b86b2
SHA256dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3
SHA5123b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
12KB