Analysis
-
max time kernel
133s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-10-2024 13:01
Static task
static1
Behavioral task
behavioral1
Sample
6f0df16188d51b39c387df210a1077df_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
6f0df16188d51b39c387df210a1077df_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
6f0df16188d51b39c387df210a1077df_JaffaCakes118.exe
-
Size
671KB
-
MD5
6f0df16188d51b39c387df210a1077df
-
SHA1
abe98a6755bab5b01c2becd90a586829afcb9336
-
SHA256
e29247ccbd64ef5da34a09b073f1f638c23bd7d280724feabf900e6ac786af52
-
SHA512
9a2441c332a605893f8b192e42ef61a68d395cc86358d7f4d96dbd592668cbcdf3701bb3a581f011632e66c33a58c7235ec433011bb1c092603457efed84973e
-
SSDEEP
12288:ZDmzAbVSux7iVK+G2L4SkX8CzdBTAKl2cEGff3kvZp1FXbd4Ga/pzP:0QVSuAVK+G2pkDdBT7l3EW4Trtah
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6f0df16188d51b39c387df210a1077df_JaffaCakes118.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1692 6f0df16188d51b39c387df210a1077df_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1692 wrote to memory of 3356 1692 6f0df16188d51b39c387df210a1077df_JaffaCakes118.exe 84 PID 1692 wrote to memory of 3356 1692 6f0df16188d51b39c387df210a1077df_JaffaCakes118.exe 84 PID 1692 wrote to memory of 3356 1692 6f0df16188d51b39c387df210a1077df_JaffaCakes118.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\6f0df16188d51b39c387df210a1077df_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6f0df16188d51b39c387df210a1077df_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\6f0df16188d51b39c387df210a1077df_JaffaCakes118.exe"2⤵PID:3356
-