Analysis
-
max time kernel
14s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
07-02-2025 13:44
General
-
Target
JaffaCakes118_b7a532f4b00925d636882e80f49305a8.exe
-
Size
459KB
-
MD5
b7a532f4b00925d636882e80f49305a8
-
SHA1
ae88858ea8c3a7ba2ed373cb104ef2152fb44b54
-
SHA256
f417f9088e6c39c418ecf8efbf0038362945788838bd7e67efd89199ada15ccd
-
SHA512
551fe3425b17f29b1c8157b2fdf6c6c0ed15c655bc14e9b73ec38209c55191444762eeef61ae933047079243b9487f92b649f5852b3f22d4bac5d070f523b706
-
SSDEEP
6144:tiz5qrDTz5rXpeCLL9tLD2hvkz/wK3TrrrYbsUu/SVeNi8DXXAE:LXeCvUkjwKYblE
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b7a532f4b00925d636882e80f49305a8.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b7a532f4b00925d636882e80f49305a8.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
4KB