Analysis
-
max time kernel
151s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
08/04/2024, 19:25
General
-
Target
e838f6d36fbf4e265ac274030216b584_JaffaCakes118.exe
-
Size
4.5MB
-
MD5
e838f6d36fbf4e265ac274030216b584
-
SHA1
69b023ccffa45092406bead777a5c3dd5ada5961
-
SHA256
d3c1c411550e4c14812b47f5576f36f4082644312483b8908228d3d364db9bb6
-
SHA512
2ad7c43f17b7f9dff0395b0db31799b3baf8dde874b7735846b57f139f831875005c03f3546b86a3ffc9bf9de0f500c8d74e33167782f3883f0990da7581dfe2
-
SSDEEP
98304:PX4z31nFnc3hnY2eRODwhZDO9e/DKeW+0byazx14:vE1n+3u2eIDwTDaODybya0
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 3 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 16 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e838f6d36fbf4e265ac274030216b584_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e838f6d36fbf4e265ac274030216b584_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-T7097.tmp\e838f6d36fbf4e265ac274030216b584_JaffaCakes118.tmp"C:\Users\Admin\AppData\Local\Temp\is-T7097.tmp\e838f6d36fbf4e265ac274030216b584_JaffaCakes118.tmp" /SL5="$80022,4059836,721408,C:\Users\Admin\AppData\Local\Temp\e838f6d36fbf4e265ac274030216b584_JaffaCakes118.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Delectus\harum\Voluptas.exe"C:\Program Files (x86)\Delectus/\harum\Voluptas.exe" 3f97056845059c859004ef5d0b34040f3⤵
- Executes dropped EXE
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.7MB
MD59c474a71a02523450b55bf5814d9d405
SHA1b80acece588f54c19ad6a55b63308a0b414f22c1
SHA2563b4d6e737e82cce1afa95a28f92a3aced97eb1893bd47489cbe03aac2a187cb0
SHA5125dcb21b6b589ee0dc79305f2aacf119429e105ad3b218806ce9a6d225a4a5739a6e8c9554de580f0ecc6af02db5934081a831cd5307969724d4227d749a14a6c
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
2.4MB
MD53fddfbaa9d029821152e746edbabf7ce
SHA1703690b3a2377047f6755e9b5274d608791b8062
SHA256787cef456bd60075199c04ac38dd5e65291bd3a930b132538889e4dafb76fa1a
SHA512fd50e763c6523022f1be02a6a690d2a2dec4e9a73c941314b4a810bbd7605d4058c5c49c53dcbdd8fde5e6c4d2c78fcec52b5bca087cbf552bc1ce90819c4903
-
Filesize
760KB
-
Filesize
760KB
-
Filesize
760KB
-
Filesize
4KB
-
Filesize
2.5MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
18.8MB
-
Filesize
18.8MB
-
Filesize
18.8MB
-
Filesize
18.8MB