Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
03/05/2024, 02:03
General
-
Target
0f6b795aef21613937cc808f32b8710f_JaffaCakes118.exe
-
Size
448KB
-
MD5
0f6b795aef21613937cc808f32b8710f
-
SHA1
438666a35f386eba055e1a7f24af941f7a8ad605
-
SHA256
059a3d046068f410f788a52a13b618925e6c290c97d2e29e9acbfe10b71f4d79
-
SHA512
c70133f53546ae50b2537a3182a55cac0287e97dfd9f6ee92fab86ff956f15af4de680f2ac0f93dde2dd1670620127fa6a4a626d9a6a0f44456662a114c39429
-
SSDEEP
12288:1N/9+8aGxbEJNOei2W/HZIaw6iYlS8ag3uID:JaGB2NOei2WBiYlSvg+a
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 3 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 6 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NSIS installer 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of SetWindowsHookEx 5 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f6b795aef21613937cc808f32b8710f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0f6b795aef21613937cc808f32b8710f_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Y73ÖÖ×ÓËÑË÷ÉñÆ÷\Y73Client.exe"C:\Program Files (x86)\Y73ÖÖ×ÓËÑË÷ÉñÆ÷\Y73Client.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
439KB
MD5a8f24d2681a2d9fe5192ec5d852b677d
SHA1c7ac4f340d3121937336850d391bd163eb6783cd
SHA256900a0b5c116b4e9d8d90037edf348dbf1bea9944c2beee47371e66c078b16e26
SHA512977d2a34df67487333e15d29005e86a6b660d65abf70d1e9de4cf03a7b9584a1c6dc84ce503e48a191c12b8e81f9dd882f1dee20c25359046e73576c3b7ac943
-
Filesize
36B
MD595b82851b17c94652b931b5624e09d5d
SHA1813be890697d13b5d5581bbec03aa737065a0571
SHA2562e7724cdebe67ad2cecea8c78669bcb3c12c4ebdd7d0fc76aa8bce535ad416da
SHA512484c8492c545723e7ff39f7911e3ac9cda4d2b9c8f6007f10d18d79c75c30ad3efc398f8e149e90a01c18b6b30055048a5993141d74cba237129914936b24880
-
Filesize
67KB
MD5a9691e1c39f11b6b7efb2b4707d2438e
SHA18305ebbb313968eac7432ae769ab8f375ee28f10
SHA25607bc825adea236a57982ac69235f40675961c8535e0ad17f8389cc9ee472dda7
SHA512d955b7df708c58f521223f8dd0d9b7ad8bb085a293ee18b480f7ab0d1d60f419068aad935c81c951ad1d271fe8d99a0d8530cb236d049686cc3e39c97b4071db
-
Filesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
Filesize
172KB
MD5fe763c2d71419352141c77c310e600d2
SHA16bb51ebcbde9fe5556a74319b49bea37d5542d5e
SHA2567fdf10ca02d2238e22fda18dfbede9750da9f257221802c8b86c557c19c9bc7b
SHA512147b3a525b1fef98ae46923dcbe25edfcf7b523f347857466eefa88f09ec053ba309dfbee5f1454ec64aba0518ee21986c4b6a506f8550efb1163c8f04d7482c
-
Filesize
224KB
-
Filesize
460KB
-
Filesize
460KB
-
Filesize
460KB
-
Filesize
224KB