Analysis

  • max time kernel
    122s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    23/03/2025, 21:42 UTC

General

  • Target

    JaffaCakes118_882a374893efeef2668ed1a27c6c1cac.exe

  • Size

    334KB

  • MD5

    882a374893efeef2668ed1a27c6c1cac

  • SHA1

    f1bd7a6482b2c3aee55805f9cd424e1f68e10905

  • SHA256

    fc7498da25574f075c5be979db3568f6d8ccb1f4664db3a2469daf1612ea573d

  • SHA512

    4f1c002aa248b3e19fd49e73ebc6bc47b5422d356ae99535082a051faef1ce70579f3a1e19527cce69bce8ed48450830a8ace6c50160e9f0dec90724a567b300

  • SSDEEP

    6144:v++o/tVgoVWj9kYYg+JfCRuZlYVZgaccA7wiVpcC6XgERSD9G5jecRSc68MA+fsa:inVW8ncC6Xz4s5jOp5sAa84OV

Score
5/10

Malware Config

Signatures

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_882a374893efeef2668ed1a27c6c1cac.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_882a374893efeef2668ed1a27c6c1cac.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:1652

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1652-0-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1652-3-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.