Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
08/05/2024, 11:06
General
-
Target
24906518a9270d7889b47732c8610d0b_JaffaCakes118.exe
-
Size
47KB
-
MD5
24906518a9270d7889b47732c8610d0b
-
SHA1
cc9f9536549df108d35439b482f31013a7404a5e
-
SHA256
45a7066b6de6d2be54fe070955c31d38c5892c0fa998fdf536496205071f65aa
-
SHA512
9671fbea77417143ba64cf17916312abb8cb5e9622aa363cae4147b45d67280003697346ee096030809a5c58722a6a31f6c181831c0775e599000d7c5149b22f
-
SSDEEP
768:eS4sULWW4pX3lRrQiT9gSZXUJiSOQXRntXoSPtAKSoxoKV6VPw5VFhrRqWImF9Bw:JPUg3lR8iT9XUJi6NhqKV2orXFb
Malware Config
Signatures
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\24906518a9270d7889b47732c8610d0b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\24906518a9270d7889b47732c8610d0b_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
47KB
MD524906518a9270d7889b47732c8610d0b
SHA1cc9f9536549df108d35439b482f31013a7404a5e
SHA25645a7066b6de6d2be54fe070955c31d38c5892c0fa998fdf536496205071f65aa
SHA5129671fbea77417143ba64cf17916312abb8cb5e9622aa363cae4147b45d67280003697346ee096030809a5c58722a6a31f6c181831c0775e599000d7c5149b22f
-
Filesize
120KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
120KB
-
Filesize
8KB