Overview

overview

3

Static

static

3

41d399916a...18.exe

windows7-x64

3

41d399916a...18.exe

windows10-2004-x64

3

Analysis

  • max time kernel
    149s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/10/2024, 20:06

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    41d399916a9ebb59a17f42af40f2fdb9_JaffaCakes118.exe

  • Size

    565KB

  • MD5

    41d399916a9ebb59a17f42af40f2fdb9

  • SHA1

    7a9dba2df4d525ec207e92c1ff6002ffbc8265e4

  • SHA256

    ab97e384533992256e3f9757c361d8d26c4edf13d2e055d56fd33b2edc528956

  • SHA512

    73132cb3f6333c98d3cc4e6e00280c729cb07d18427be83c52c8cd6671fbc5d03bd47d40b2fbfd02aebada6aaa78f3de8b4007c891d6cde236018ae1072313b1

  • SSDEEP

    12288:xRbu/jtigh+M9lbfx3yABdvStQiH4u3cS6K:fOsghzh/WS6fcSN

Score
3/10
discovery

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 30 IoCs
  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\41d399916a9ebb59a17f42af40f2fdb9_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\41d399916a9ebb59a17f42af40f2fdb9_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:3432

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/3432-0-0x0000000002250000-0x0000000002251000-memory.dmp

          Filesize

          4KB

          Download

        • memory/3432-1-0x0000000000400000-0x0000000000494000-memory.dmp

          Filesize

          592KB

          Download

        • memory/3432-2-0x0000000002250000-0x0000000002251000-memory.dmp

          Filesize

          4KB

          Download