Analysis

  • max time kernel
    133s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-10-2024 16:51

General

  • Target

    8002773ca1dbb84c778b1a327bde8d2d_JaffaCakes118.exe

  • Size

    423KB

  • MD5

    8002773ca1dbb84c778b1a327bde8d2d

  • SHA1

    786baed805bffd9d3c0d6831a3b777f7d9430c98

  • SHA256

    bb17a769bbbf9be26e21982dc13b4d7da2b1a548a061c3e3e4dbdbe6491b1075

  • SHA512

    0e268e2c31d1cf0c8a282a436a745d934ee5a31aef8cf419b81461a95b6fa0f3631c732d91148637f0f7c7619d303020ca41052229dd28af79059de6444a815c

  • SSDEEP

    6144:dO/I1GOmJ26vuIMIWHPP7qW8ywhysKRRl35qPzBP+Di1ph1ReaD2qahSXIMI:0Omk62BrvP+/E535qPVmDi1Z0+X

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8002773ca1dbb84c778b1a327bde8d2d_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\8002773ca1dbb84c778b1a327bde8d2d_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4400
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\91EF.tmp\3329E_for_exe.bat""
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3668

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\91EF.tmp\3329E_for_exe.bat

    Filesize

    3KB

    MD5

    e88600751e0e9ac370919e2c0d7fb2a9

    SHA1

    fbc3ebeadbf75488068d89d95873ad5845c2ff2b

    SHA256

    60f21b020760098e1bd88941926012ab25b44ac4530fc60dc5c888cf164a5b1f

    SHA512

    e6e6ea8db28618085b7e68522584f1b7565e78334c6fd8d98c357e87b8c6992c73c573a46049b0d10d6f1da62e0e93708ccac2e47b1bb69fd7060cf5147eaf8f

  • C:\Users\Admin\AppData\Local\Temp\91EF.tmp\b2e.dll

    Filesize

    31KB

    MD5

    7b860f28be19d4aef761fb991134a556

    SHA1

    0658a7456d0234dcca598b6ee599fe134d0ecd61

    SHA256

    57a2586d73188a694944c7da60c78380f82fac46452ed1a31c818ceb93e660bc

    SHA512

    a0685a25cbc3fff74aa4ad538ade5282242980f07fe1171e01644e0fa98e1ec6adc87b943290983f6fb5070d26fc15d697ae31a1f570e83e504ae1e4508aefa5

  • memory/4400-0-0x0000000000400000-0x0000000000502000-memory.dmp

    Filesize

    1.0MB

  • memory/4400-26-0x0000000000400000-0x0000000000502000-memory.dmp

    Filesize

    1.0MB