Analysis
-
max time kernel
149s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
21/04/2024, 14:57
General
-
Target
ff8a950178dedea2cd5fac32eabe05a7_JaffaCakes118.exe
-
Size
476KB
-
MD5
ff8a950178dedea2cd5fac32eabe05a7
-
SHA1
5178cc759ddb8b8c454a8f127826280e8da85c6e
-
SHA256
a3ba1dab9f4cce4e32d55e53c188b1b88022fa1d8ded84313e3c469515fbefeb
-
SHA512
757bcddd2767bd3835a1c7a1919e1661c2fece4cf27b33db5ab3ce2f8e3b7869d982d89a3e3ffbb9f870d2f3bb3fd6aab8bb991c4364361a2dd050e07f311702
-
SSDEEP
12288:A29PHZyMqlqvkbXzz2jaSleSNevjm+lzHlXy3sxjGnhB:A29oZHbXejaGef79zHlC3wQ
Malware Config
Signatures
-
Disables Task Manager via registry modification
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Internet Explorer settings 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff8a950178dedea2cd5fac32eabe05a7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ff8a950178dedea2cd5fac32eabe05a7_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Maps connected drives based on registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\ProgramData\XXiouIlxcI.exe"C:\ProgramData\XXiouIlxcI.exe"2⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
476KB
MD5ff8a950178dedea2cd5fac32eabe05a7
SHA15178cc759ddb8b8c454a8f127826280e8da85c6e
SHA256a3ba1dab9f4cce4e32d55e53c188b1b88022fa1d8ded84313e3c469515fbefeb
SHA512757bcddd2767bd3835a1c7a1919e1661c2fece4cf27b33db5ab3ce2f8e3b7869d982d89a3e3ffbb9f870d2f3bb3fd6aab8bb991c4364361a2dd050e07f311702
-
Filesize
380KB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
380KB