Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
27/01/2025, 19:50
General
- Target JaffaCakes118_431e8043b14d6f16547c3d116576f636.exe
- Size 1.0MB
- Sample250127-ykcedstjg1
- SHA256 7d1cd33b77dcfc7d9954be0b812dfb9fb6a736018829bfd406d5fe964c24b813
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_431e8043b14d6f16547c3d116576f636.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_431e8043b14d6f16547c3d116576f636.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
bootstrap_19914.html
main.css
progress-bar.css
BG01.jpg
Close.png
Color_Button.png
Gray_Button.png
ProgressBar.png
ProgressBar_element.png
loader.gif
memory/3736-123-0x0000000000400000-0x000000000050C000-memory.dmp
memory/3736-128-0x0000000000400000-0x000000000050C000-memory.dmp
memory/3736-121-0x0000000000401000-0x00000000004C6000-memory.dmp
memory/3736-122-0x0000000000400000-0x000000000050C000-memory.dmp
memory/3736-0-0x0000000000401000-0x00000000004C6000-memory.dmp
memory/3736-124-0x0000000000400000-0x000000000050C000-memory.dmp
memory/3736-125-0x0000000000400000-0x000000000050C000-memory.dmp
memory/3736-126-0x0000000000400000-0x000000000050C000-memory.dmp
memory/3736-127-0x0000000000400000-0x000000000050C000-memory.dmp
memory/3736-1-0x0000000000400000-0x000000000050C000-memory.dmp
memory/3736-130-0x0000000000400000-0x000000000050C000-memory.dmp
memory/3736-131-0x0000000000400000-0x000000000050C000-memory.dmp
memory/3736-132-0x0000000000400000-0x000000000050C000-memory.dmp
memory/3736-133-0x0000000000400000-0x000000000050C000-memory.dmp
memory/3736-134-0x0000000000400000-0x000000000050C000-memory.dmp
memory/3736-135-0x0000000000400000-0x000000000050C000-memory.dmp
memory/3736-136-0x0000000000400000-0x000000000050C000-memory.dmp
memory/3736-137-0x0000000000400000-0x000000000050C000-memory.dmp