Analysis
-
max time kernel
141s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
22-05-2024 02:42
General
-
Target
65bbf1e257aa7b30b4bf9c3a93882052_JaffaCakes118.exe
-
Size
4.2MB
-
MD5
65bbf1e257aa7b30b4bf9c3a93882052
-
SHA1
4166c61efdc97b7599163922ad00b04b80b5b3cf
-
SHA256
515a49e400209c5c4df0ebfde5f8b511b981088298434fa3b08d6e2e63fdbcb8
-
SHA512
82e9bfe094f14d7931aadbf94c20fa6e63e8e4bc3099e82a7bb6f413ab3d02bdfe3ce9038208293d03d7f97d92cd180c7aa7214ce7643ceb7af0d35281188306
-
SSDEEP
98304:RwoRIqXAfJt102DXdmdA+1xgoGKPhNHiEhDCn0U8xF7EeW:PRJXAT102DXdmdA+1xgoGKiUCh0PW
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 5 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\65bbf1e257aa7b30b4bf9c3a93882052_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\65bbf1e257aa7b30b4bf9c3a93882052_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-NA1OU.tmp\65bbf1e257aa7b30b4bf9c3a93882052_JaffaCakes118.tmp"C:\Users\Admin\AppData\Local\Temp\is-NA1OU.tmp\65bbf1e257aa7b30b4bf9c3a93882052_JaffaCakes118.tmp" /SL5="$4001C,3896000,115200,C:\Users\Admin\AppData\Local\Temp\65bbf1e257aa7b30b4bf9c3a93882052_JaffaCakes118.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5f8effd4170e2d87ac5cbde8041b7ca35
SHA1fa6d17177d7735ba2b3ecc419a2c948228c985a2
SHA2563d7368ad358eabc3b6eec988fb5a0acf4acf112e3fb5ed2ef686ed05e2c6104d
SHA512c01e4de0cae3d5c43a511c9abdfebe8b61a4dc129cbb075e8d8654255cf7dadd4c301aec12a1c78f442810b82ee81e97fb4754dd884316a27d3ce3873c11bdf0
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
200KB
MD5d82a429efd885ca0f324dd92afb6b7b8
SHA186bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea
SHA256b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3
SHA5125bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df
-
Filesize
1.1MB
MD5963af29d268f2fec39870cb520ff986f
SHA1a19a98d895eb14bb7043ece41d10d99ad8502bed
SHA2569df1a3f9c6c8911d728fde5630d741b930468690828216acfb8a9e30e4caf905
SHA512a3ebc5a7bb65adf34240cd0d2540e9420bd450a6e302bb3bc41c9d2e751a468400f4792709d65976d4766b4d49121b034254099b8181b67eee23ebeeb0f3b1b5
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
68KB
-
Filesize
1.2MB
-
Filesize
240KB
-
Filesize
1.3MB
-
Filesize
1.2MB
-
Filesize
1.3MB
-
Filesize
240KB
-
Filesize
1.2MB
-
Filesize
1.2MB