Analysis
-
max time kernel
122s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
24/11/2024, 00:37
General
-
Target
91949679731918d53508dd70be4fe076_JaffaCakes118.exe
-
Size
1.2MB
-
MD5
91949679731918d53508dd70be4fe076
-
SHA1
04c30df40dabb0058f478241af55a775b1962d1d
-
SHA256
f80ed9c0293e81eec4e5590acc8bad4227d18cd706fc0db5905eee35ccd04dd9
-
SHA512
2f779200d5eb80a0acdfe5308b19bc23ce5b9cf2f5102640c8d4582ee09230e498cf37834af95f272c05992486285dbe13def786347c7ba62fbdc45a588c65ef
-
SSDEEP
24576:UfsDyuX5UCS4lny4IysRFbRU2nkms1AGZtxwk:U01Xw4ZFIy6U2dgAotGk
Score
10/10
Malware Config
Signatures
-
Blackmoon family
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\91949679731918d53508dd70be4fe076_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\91949679731918d53508dd70be4fe076_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB