Analysis
-
max time kernel
24s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
-
submitted
10-06-2024 15:57
General
-
Target
9b3acfbcc7329bb4076590bcf06405ea_JaffaCakes118.exe
-
Size
5.0MB
-
MD5
9b3acfbcc7329bb4076590bcf06405ea
-
SHA1
080381c640febaac9b4fa902f6c890efe4d27f15
-
SHA256
ac10e43cbfc02ecb3278104fd75c5ec8817100682a711318c473fd66287e23e1
-
SHA512
7d0378f6203a70c5215bbc8a7d334256224a026ad1a32b796f866d08efb9c5e9df0ac3039bcbe18e53c07280e62a108a7188c511c4377a241ef2efd071f0a2f9
-
SSDEEP
98304:OOmWCUAtacMcP75xJIaZKcrVjYjJ5xxg57Vx9YvXR6PNjTAz8HASWOK1:O3WWDMcP75xJIVJi7Vxu0PNQz8gfb
Malware Config
Signatures
-
Glupteba
Glupteba is a modular loader written in Golang with various components.
-
Glupteba payload 16 IoCs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9b3acfbcc7329bb4076590bcf06405ea_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\9b3acfbcc7329bb4076590bcf06405ea_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\9b3acfbcc7329bb4076590bcf06405ea_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\9b3acfbcc7329bb4076590bcf06405ea_JaffaCakes118.exe"2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe /6-JaffaCakes1183⤵
-
-
-
C:\Windows\system32\makecab.exe"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20240610155748.log C:\Windows\Logs\CBS\CbsPersist_20240610155748.cab1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.0MB
MD59b3acfbcc7329bb4076590bcf06405ea
SHA1080381c640febaac9b4fa902f6c890efe4d27f15
SHA256ac10e43cbfc02ecb3278104fd75c5ec8817100682a711318c473fd66287e23e1
SHA5127d0378f6203a70c5215bbc8a7d334256224a026ad1a32b796f866d08efb9c5e9df0ac3039bcbe18e53c07280e62a108a7188c511c4377a241ef2efd071f0a2f9
-
Filesize
13.0MB
-
Filesize
13.0MB
-
Filesize
13.0MB
-
Filesize
13.0MB
-
Filesize
13.0MB
-
Filesize
13.0MB
-
Filesize
13.0MB
-
Filesize
4.8MB
-
Filesize
6.9MB
-
Filesize
4.8MB
-
Filesize
13.0MB
-
Filesize
4.8MB
-
Filesize
13.0MB
-
Filesize
13.0MB
-
Filesize
6.9MB
-
Filesize
4.8MB
-
Filesize
13.0MB
-
Filesize
13.0MB
-
Filesize
13.0MB
-
Filesize
13.0MB
-
Filesize
4.8MB