Analysis
-
max time kernel
126s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
19/04/2024, 17:25
General
-
Target
face2cfc86cbaaa01b9968133ff62d82_JaffaCakes118.exe
-
Size
212KB
-
MD5
face2cfc86cbaaa01b9968133ff62d82
-
SHA1
1b8b0f29d03b14c85feb65ab3a5a864e6ddd9e02
-
SHA256
786b64e2ae3bd75abeab86e3fcb0e5ea84b016ce75504e2fea441d5910deb3eb
-
SHA512
06e79d5b8b87e5e1bd5e701c12adc2f3f5f2287c14d27d6874a8e8cfd24070f34ca2249a0c448ff03d867f57f85db2851ec315c1dedf0669430c9db378d63387
-
SSDEEP
6144:F8S2qLUA6qHfosMcW2XHTlO34KPADymo:F0qLUKfosM2XHBK4Dvo
Score
7/10
Malware Config
Signatures
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in Windows directory 2 IoCs
-
Program crash 1 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\face2cfc86cbaaa01b9968133ff62d82_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\face2cfc86cbaaa01b9968133ff62d82_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3384 -s 16642⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3384 -ip 33841⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
452KB
-
Filesize
452KB
-
Filesize
4KB
-
Filesize
452KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
452KB
-
Filesize
232KB
-
Filesize
232KB