Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
04-12-2024 00:22
Static task
static1
Behavioral task
behavioral1
Sample
bff16109db65192d6e3fff0cebb1fa5e_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
bff16109db65192d6e3fff0cebb1fa5e_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
bff16109db65192d6e3fff0cebb1fa5e_JaffaCakes118.exe
-
Size
488KB
-
MD5
bff16109db65192d6e3fff0cebb1fa5e
-
SHA1
a75c7bcb37fcca2d33604fd7356dbd983b38e586
-
SHA256
7ae95e4755b985d74dea31bf4c7e8e4d9dc825c358c3b4ec55882ed7ac206538
-
SHA512
fa03aa08a54590b2b7d712d8c745a6969b94fb83093fa6ba7ba5b1b38a7b95ed0e7eaed4b9edbb68a35a6414e9943d9b989f73b95381fade486501911d23fe07
-
SSDEEP
12288:rUlqSgqhJvfke4HU5K+Dy6lSC8u8yN0sqpwRc+EPW2Oh:rq9RvQqu6lSIjNlqFfe26
Malware Config
Signatures
-
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created C:\Windows\assembly\Desktop.ini bff16109db65192d6e3fff0cebb1fa5e_JaffaCakes118.exe File opened for modification C:\Windows\assembly\Desktop.ini bff16109db65192d6e3fff0cebb1fa5e_JaffaCakes118.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\assembly bff16109db65192d6e3fff0cebb1fa5e_JaffaCakes118.exe File created C:\Windows\assembly\Desktop.ini bff16109db65192d6e3fff0cebb1fa5e_JaffaCakes118.exe File opened for modification C:\Windows\assembly\Desktop.ini bff16109db65192d6e3fff0cebb1fa5e_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bff16109db65192d6e3fff0cebb1fa5e_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3568 wrote to memory of 1588 3568 bff16109db65192d6e3fff0cebb1fa5e_JaffaCakes118.exe 82 PID 3568 wrote to memory of 1588 3568 bff16109db65192d6e3fff0cebb1fa5e_JaffaCakes118.exe 82 PID 3568 wrote to memory of 1588 3568 bff16109db65192d6e3fff0cebb1fa5e_JaffaCakes118.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\bff16109db65192d6e3fff0cebb1fa5e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\bff16109db65192d6e3fff0cebb1fa5e_JaffaCakes118.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\bff16109db65192d6e3fff0cebb1fa5e_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\bff16109db65192d6e3fff0cebb1fa5e_JaffaCakes118.exe2⤵PID:1588
-