Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
13/10/2024, 05:15
General
-
Target
3dff3fc0c70f6a92bd40c2669891280a_JaffaCakes118.exe
-
Size
806KB
-
MD5
3dff3fc0c70f6a92bd40c2669891280a
-
SHA1
6539f0c7e0e7682835c19bd64401b77107ad6407
-
SHA256
02b75755ccb65895499d6a6565085fb2902701779f2c96dd56d5eae6c4972536
-
SHA512
740eca4f5e79a0acc966df0067982ed013f8167c7921e6cb72492dbcf4e712415f219bf7c25fdc68f4dc09aa5a1d19652ee54ffc4253d20dd2a6983e58b3196e
-
SSDEEP
12288:5NmYXFdzcnOlpIRCthqY3UXbEuUINirx9qLOMt0acGh9KZR6qequiqgDukiVhww2:5QEFeO8CtoNiT2DtCDTKAqGziVhwdV
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3dff3fc0c70f6a92bd40c2669891280a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3dff3fc0c70f6a92bd40c2669891280a_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
616KB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
616KB