Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
18/04/2024, 16:12
General
-
Target
f8537468081b0e4be44c420cc36af571_JaffaCakes118.exe
-
Size
28KB
-
MD5
f8537468081b0e4be44c420cc36af571
-
SHA1
35781b5fd883fafb85477e77be2be47f30017024
-
SHA256
3fc10b5c7aa573fbdd5b3cae77e4322894cca7a20a46aa510e7b309aab75991e
-
SHA512
c678d9f693518c9ce9a95ccc41399c66b33b39af53d4d69e4f5f42e01222735474018ab8dd57e42117d3646fe5c2ad630db4144ba188aa43ed33d87f6dfe3267
-
SSDEEP
384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNwG83H:Dv8IRRdsxq1DjJcqfz9H
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 23 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Drops file in Windows directory 3 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f8537468081b0e4be44c420cc36af571_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f8537468081b0e4be44c420cc36af571_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
175KB
MD54409154ec57983ce609898b13ce6abec
SHA1e824dafb341d85b0db25fad247ad3415754a7427
SHA2564265ae3fa01749b3e97f5bb17c59b3928034075913ef9e7db2e85d09652cb38a
SHA5122820b4c633148ce78b686d4d09597e32b5afa8ebcbe0f935831b1b8f93929da851921bd9d7081c529a82e27c8b5aca78d31cdc4a4807cb766f6a13f186c3e387
-
Filesize
28KB
MD564db27ea1e0f77f35527e52fae3670f1
SHA1b94fd879a83948b5c83ba758c6f11b485a68e66b
SHA25672017903cc34653f8e0699e5d37fb116b8e8598205b821089cb9943141e0f84a
SHA512c87851ece3fa53ddbf14b63b023eeb9460ce438181316f23484298bb76a2b7ce5ba32256788cdb8d2bf73dc49784b6b147d135ff009c4f3c1a0aabe334b8156f
-
Filesize
1KB
MD5623b30eacb5388e913afdd6fe87fa921
SHA1ad7711a32ba7fa833632f59b2cd2ffcd1ddf3956
SHA256dd8aa26ed52ee75ea2827355869f4e527f73dddfe4ddf33fab1a0187c096913e
SHA512fa89bfe051ae00209c8b16aee3ae5c46cfa46be5b69d50ca83a30e04275c3accfa07c7b29bd35882036500be165a284a623618c20df22ce3861f3dbbfc7bb391
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB