Analysis
-
max time kernel
142s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
10-04-2024 14:29
General
-
Target
eb4726176b7d6def7512e21d02ed6c6b_JaffaCakes118.exe
-
Size
14.8MB
-
MD5
eb4726176b7d6def7512e21d02ed6c6b
-
SHA1
09c1de26004401ab735ff0017ccc3c056bdb0097
-
SHA256
24a82936420cde7f9dfb7e95ad21dd82ec4e08098154d213efaf98e3022cf9b1
-
SHA512
8206fa8a83c24cf58032f34bec6ca0a0892b5db182eee3caab992c41ddf2ee4bef99f8b219e12d36ec8449470e067f8207237d8c023452493c9745da46db8523
-
SSDEEP
393216:2Pzn/SFKehyVIpQq362HTeLIfYw3W5gWd3lNw0:2rSphyCO52zeLIfj6jj
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Internet Explorer settings 1 TTPs 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\eb4726176b7d6def7512e21d02ed6c6b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\eb4726176b7d6def7512e21d02ed6c6b_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1rwcbign.hld\eb4726176b7d6def7512e21d02ed6c6b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1rwcbign.hld\eb4726176b7d6def7512e21d02ed6c6b_JaffaCakes118.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
187B
MD5df6389f4676a99c481cbbaed9d0179fe
SHA1f386f5fd4bbab6fe738230b4a02066fe649f7aa1
SHA256af4dc7304bfe9da3cff1646a90ed298a3a6df62047775970ff0abed7c6e9779e
SHA5125a2e897daaceaff61e7a7fd4b2771e4a75e3973188bc546f0cdea8d15b19cb732bad99a470163a98336f53f33a2ec69153c028fd4dd62d16e26d2042a8e737ab
-
Filesize
44KB
MD50c033d2d431acf451488fa8eedf7abdc
SHA1e1296633918c8ef6653847dedcd7bfa9e12cb627
SHA25699b1943e1dda4dce98f339c75941a709bbfbf6d93243cd8c3e2887d8c27136d5
SHA5126006a3cb375154506fc6ef5338c3458e78d7aa568c8f167433182cf00781c9bf67579fe32824fd4c8754ad48e48a5740151a9dafadde372229a2032e9183b6da
-
Filesize
16KB
MD5d645bc10d1d3209e03495ba67d167757
SHA11ea1c520251538032952825e11c55519a039189e
SHA256f411aa3b252e12cb6192b052819337096a855cb182e89110f3bad35c68fc137f
SHA512d640797b117f9ec0c2570565da0294f93e7fc3fc5dbff8492221266889d8c27c162bfa07dd1eb8d18e85fcc3e9f6d2801cc18cc9faa3e7cf123566b3f229f42e
-
Filesize
123KB
MD5d3a5b20d5368c1bcabe655b57b52d097
SHA1015cf89260f3e8f0b86f5a17558125c933692989
SHA256e9cca17c4320baac34e9ea5a41357ae0baffdd1beed813c2ef1f82d1179e9868
SHA5121fd0889623b195a6faf905a2a662fc08173e76ac9490e2aaf9a96390f2184d71c1d5f29c61553bab34a3ea4626226fbd9eba4a2085afb5994290c31fb87a68c0
-
Filesize
1KB
MD53ac507e36b0f2e55571133ad1b0fa400
SHA15d11312861c5c6750ff60c79646951064906d8b7
SHA2567dbcc036716712e3a82b915160faa7c7ed897d25581331eabe802a10131bd753
SHA51207a6da7bc8c7b7984076366dd2b2d96bda39ba853a1b74254cf550e767627ff15725a21e3bf91f859c44d770106840f87912591d32861e203653f0f1e6eac43e
-
Filesize
1KB
MD50804815d42b4373f96f13bd7f059e8d7
SHA1353ee8f970ec5f96eef70f050adf0985305b17c0
SHA256de1fc9576eb440940a8927e4c1f7da6632ed91a3ea5763b661bf0d2465a2d4c7
SHA51295304808e4a6cf2f684059a65e96fd8a264369d84f04c57a83d389035a31552c19439ecd4a32db515f57538aa83e06fdb4799bb94e366be660137298800f8b98
-
Filesize
1KB
MD50ea518f9fb46e2389269003bea78436d
SHA1fb0a3abe4bb4de9e5f026ec96cc2f89591207c39
SHA25654df739334ffb628170df192a4ba16f0fb78465dc375b40a29b51cf4bfc39de7
SHA512bf931b05539f612a819e06e7ffb08d227202232b6345444d22002b11ef9fb292ffc2cb386a96d99ae6ed781daec40c5f2a3cd1a482a701a9d5573d86815bc4b8
-
Filesize
893KB
MD504ad4b80880b32c94be8d0886482c774
SHA1344faf61c3eb76f4a2fb6452e83ed16c9cce73e0
SHA256a1e1d1f0fff4fcccfbdfa313f3bdfea4d3dfe2c2d9174a615bbc39a0a6929338
SHA5123e3aaf01b769471b18126e443a721c9e9a0269e9f5e48d0a10251bc1ee309855bd71ede266caa6828b007359b21ba562c2a5a3469078760f564fb7bd43acabfb
-
Filesize
14.7MB
MD5ed394f4207825fede2cd78231cc375b8
SHA19a2694464a4d813f677c1edb5e1864c0c7d41f7c
SHA2566741aa059caf95e1f40ebb9bfabe137bdd94896c59102d80713e6a1b8a6d7ff7
SHA512dbb44538f0043a8fc5c92a817f3bb10e777277e2960ffeb02045b5e5f9602588b29f251e1b5984f7981d442208ca49d6b5b4b5b063149bf09b1fb38e14271dbe
-
Filesize
12.3MB
-
Filesize
960KB
-
Filesize
256KB
-
Filesize
688KB
-
Filesize
348KB
-
Filesize
284KB
-
Filesize
36KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
12.3MB
-
Filesize
1.4MB
-
Filesize
364KB
-
Filesize
212KB
-
Filesize
1.1MB
-
Filesize
20KB
-
Filesize
572KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
92KB
-
Filesize
84KB
-
Filesize
328KB
-
Filesize
100KB
-
Filesize
52KB
-
Filesize
316KB
-
Filesize
100KB
-
Filesize
112KB
-
Filesize
352KB
-
Filesize
156KB
-
Filesize
48KB
-
Filesize
960KB
-
Filesize
244KB
-
Filesize
364KB
-
Filesize
284KB
-
Filesize
688KB
-
Filesize
1024KB
-
Filesize
348KB
-
Filesize
296KB
-
Filesize
1.4MB
-
Filesize
5.7MB
-
Filesize
500KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
212KB
-
Filesize
24KB
-
Filesize
20KB
-
Filesize
328KB
-
Filesize
84KB
-
Filesize
52KB
-
Filesize
352KB
-
Filesize
156KB
-
Filesize
28KB
-
Filesize
112KB
-
Filesize
316KB
-
Filesize
960KB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
1.4MB
-
Filesize
960KB
-
Filesize
688KB
-
Filesize
296KB
-
Filesize
500KB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
1024KB
-
Filesize
256KB
-
Filesize
244KB
-
Filesize
960KB
-
Filesize
4KB
-
Filesize
296KB
-
Filesize
244KB
-
Filesize
960KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
960KB
-
Filesize
256KB
-
Filesize
5.7MB
