Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
12-10-2024 15:52
Static task
static1
Behavioral task
behavioral1
Sample
3adc9b66b8aef855732e926f2579ef5a_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3adc9b66b8aef855732e926f2579ef5a_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
3adc9b66b8aef855732e926f2579ef5a_JaffaCakes118.exe
-
Size
336KB
-
MD5
3adc9b66b8aef855732e926f2579ef5a
-
SHA1
5fb06661a98a8e93ba12697e0eb8c23b240c904b
-
SHA256
ce3f7b84bb812b0fe7216b09981856257cda468449e7efce6b80b1807fbd3b80
-
SHA512
4446b0aa66ccff6423427e6b7260e1bd2837f22546a1b353579bd991cf99f5504c850240b1282aee3febb64ff27304701e0a458944267519a147ff4ae0736841
-
SSDEEP
6144:fto9tdao+Ozx119JCUCIcMXltFClemrlCAT9dwkd0M8GBseRlEPswbga:AxNJCUCOrEVpT2MEPscga
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2772 3adc9b66b8aef855732e926f2579ef5a_JaffaCakes118.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\oledsp32.dl_ 3adc9b66b8aef855732e926f2579ef5a_JaffaCakes118.exe File created C:\Windows\SysWOW64\oledsp32.dll 3adc9b66b8aef855732e926f2579ef5a_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3adc9b66b8aef855732e926f2579ef5a_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2772 3adc9b66b8aef855732e926f2579ef5a_JaffaCakes118.exe 2772 3adc9b66b8aef855732e926f2579ef5a_JaffaCakes118.exe 2772 3adc9b66b8aef855732e926f2579ef5a_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3adc9b66b8aef855732e926f2579ef5a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3adc9b66b8aef855732e926f2579ef5a_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2772
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25KB
MD526f30e177d62e78e82b1b550868ff3ba
SHA19eb0f346ff80be8e0c072b8508f39527982fa64b
SHA256c533d2dd651df0c1a97c7b0e5784b9a42a58e5e64115b540e8c521cbd192e1ca
SHA5129948211e30ce42860adf23a80b2c2f25397311ec699999d42466ef46d1ae79c883393f0bcefbbcbf5ecd6a6c6d36d99c4a38631a5144506efab76dbcb01f29c9