Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31-10-2024 00:55

General

  • Target

    80eb6e576932743d0d6a0744065c5580_JaffaCakes118.exe

  • Size

    562KB

  • MD5

    80eb6e576932743d0d6a0744065c5580

  • SHA1

    1a72e610be1d7f72b671a8e2d67187af6aeab6bf

  • SHA256

    58b4acf11d22f7cfb2872b36d63b60ff30da61ecf480453a9877b32b2eda92b2

  • SHA512

    cc5509a15a35dd56bc1a1d44ea941d9c9a67c1b8431d21bc89d840b838b9c3cb938ae04ce5e9c7a7d074cf5ea27ef4cfed61e70d157b409379abcedf4f184a13

  • SSDEEP

    12288:Iu3URWtsYf8PemjE8h0UxH9ND6fvhMrf1seW2/ag2n+G:IkQe8PemjTh0Ul/8vh+qUA+G

Malware Config

Signatures

  • Event Triggered Execution: AppInit DLLs 1 TTPs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\80eb6e576932743d0d6a0744065c5580_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\80eb6e576932743d0d6a0744065c5580_JaffaCakes118.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:3400
  • C:\PROGRA~3\Mozilla\hqortka.exe
    C:\PROGRA~3\Mozilla\hqortka.exe -tayspuk
    1⤵
    • Executes dropped EXE
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:4448

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Mozilla\hqortka.exe

    Filesize

    562KB

    MD5

    97f03dbeaa1092c26b0d81a12d93e66e

    SHA1

    8e86ab9b5f081e7c8ad59737da919f9ec7f9e026

    SHA256

    9c6c80cbf41477252fa23f0e40cbc50a4f7c6cf1fd706c1f02b72a8fca09469f

    SHA512

    989f7815348dc239f504540d566e14a2e378544dc05edb635c0dd43833c62b2e60e819041df573be881a276d49c480faf1394f8052d6da5ff2dfbae2208834f8

  • memory/3400-0-0x00000000021D0000-0x000000000222B000-memory.dmp

    Filesize

    364KB

  • memory/3400-1-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/3400-6-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/3400-8-0x00000000021D0000-0x000000000222B000-memory.dmp

    Filesize

    364KB

  • memory/4448-5-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/4448-9-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/4448-11-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB