Analysis

  • max time kernel
    123s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    30-11-2024 04:52

General

  • Target

    b4dd126a8a85297f6695d1e89f8a827b_JaffaCakes118.exe

  • Size

    88KB

  • MD5

    b4dd126a8a85297f6695d1e89f8a827b

  • SHA1

    888390b12724c4f7de484029b081cc5cd78d239d

  • SHA256

    e055346bbcea8acc879fc9ab7cc231658971d42f463c1a4a139a139fbbb95ac7

  • SHA512

    0c0c5899ff61b487469dad1a4348ef2ec7f8e04c6a21509c4165dd7f8864ead17360b9198c79c602123c5e3d31dfb7cc14bafa4245421be0c171aaf6d4791572

  • SSDEEP

    1536:t5piVnDXkTbhCtaB6GVA/bVQPxfgiqfoOonoKg+yOH5y/yEP:6D0ctAVA/bmxIMnoKjyR/NP

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b4dd126a8a85297f6695d1e89f8a827b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\b4dd126a8a85297f6695d1e89f8a827b_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:2420

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2420-2-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB

  • memory/2420-14-0x0000000000260000-0x0000000000261000-memory.dmp

    Filesize

    4KB

  • memory/2420-4-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB

  • memory/2420-58-0x00000000005C0000-0x00000000005C1000-memory.dmp

    Filesize

    4KB

  • memory/2420-38-0x00000000002E0000-0x00000000002E1000-memory.dmp

    Filesize

    4KB

  • memory/2420-26-0x0000000000280000-0x0000000000281000-memory.dmp

    Filesize

    4KB

  • memory/2420-68-0x00000000005E0000-0x00000000005E1000-memory.dmp

    Filesize

    4KB

  • memory/2420-256-0x0000000000830000-0x0000000000832000-memory.dmp

    Filesize

    8KB

  • memory/2420-253-0x0000000000820000-0x0000000000822000-memory.dmp

    Filesize

    8KB

  • memory/2420-251-0x0000000000600000-0x0000000000602000-memory.dmp

    Filesize

    8KB

  • memory/2420-45689-0x0000000000830000-0x0000000000832000-memory.dmp

    Filesize

    8KB

  • memory/2420-45687-0x0000000000820000-0x0000000000822000-memory.dmp

    Filesize

    8KB

  • memory/2420-45685-0x0000000000600000-0x0000000000602000-memory.dmp

    Filesize

    8KB

  • memory/2420-485568-0x0000000000880000-0x0000000000980000-memory.dmp

    Filesize

    1024KB