Analysis
-
max time kernel
139s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
14-10-2024 18:18
Static task
static1
Behavioral task
behavioral1
Sample
438d8622afc2ec788d31ebdcaf9311ee_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
438d8622afc2ec788d31ebdcaf9311ee_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
438d8622afc2ec788d31ebdcaf9311ee_JaffaCakes118.exe
-
Size
104KB
-
MD5
438d8622afc2ec788d31ebdcaf9311ee
-
SHA1
269edac282e6771e98fea280b4acf01018f3542b
-
SHA256
1e2312804f9c5d6abaa6abaa8b0372ca1e29a4dc66b20c4f4672752b2d23132a
-
SHA512
d75229ec592d8176246312146c701cdfbd8ad989cb3d78818734657fe0007d8c9f0b347ecc0192c61b04392c56db512d84cd5c9213bc81f883784db758eab8a2
-
SSDEEP
1536:PzHfUGxNiunKsRb7sj05rLreJA4j0xPsciQ38a6tFcBdP:L/rb42DiQ38a6tFmdP
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 438d8622afc2ec788d31ebdcaf9311ee_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ipconfig.exe -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 404 ipconfig.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3404 wrote to memory of 3592 3404 438d8622afc2ec788d31ebdcaf9311ee_JaffaCakes118.exe 84 PID 3404 wrote to memory of 3592 3404 438d8622afc2ec788d31ebdcaf9311ee_JaffaCakes118.exe 84 PID 3404 wrote to memory of 3592 3404 438d8622afc2ec788d31ebdcaf9311ee_JaffaCakes118.exe 84 PID 3592 wrote to memory of 404 3592 cmd.exe 87 PID 3592 wrote to memory of 404 3592 cmd.exe 87 PID 3592 wrote to memory of 404 3592 cmd.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\438d8622afc2ec788d31ebdcaf9311ee_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\438d8622afc2ec788d31ebdcaf9311ee_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C ipconfig.exe /displaydns2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Windows\SysWOW64\ipconfig.exeipconfig.exe /displaydns3⤵
- System Location Discovery: System Language Discovery
- Gathers network information
PID:404
-
-