Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/10/2024, 02:43

General

  • Target

    550b8ae72ec070cc425847a29959d8bf_JaffaCakes118.exe

  • Size

    122KB

  • MD5

    550b8ae72ec070cc425847a29959d8bf

  • SHA1

    05093d217c515aa3be8ff8dffe84678867b4791a

  • SHA256

    ee9e733903cc55e48171d32d2f3d814e336ca5675c97f94501a085b27b0427c9

  • SHA512

    21b6e53ef2d9897c1020475115fbcba5ab771e031fce2096e0f933cd31a65b4e8a0218b8297e9c995047c5fba167e5d7e7469f6c501bb695f74ff570f3e8bebc

  • SSDEEP

    3072:StDM8zut/AAAAApjfHYgBPvVCBWdMyPrLPjpE1HBbf1i6+GOe:SMAAAAAZPwYP3PjpAr/+be

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\550b8ae72ec070cc425847a29959d8bf_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\550b8ae72ec070cc425847a29959d8bf_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:1332

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1332-0-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

  • memory/1332-1-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

  • memory/1332-2-0x0000000000428000-0x0000000000440000-memory.dmp

    Filesize

    96KB

  • memory/1332-9-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

  • memory/1332-16-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

  • memory/1332-17-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB