Analysis
-
max time kernel
135s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
13-06-2024 07:35
Static task
static1
Behavioral task
behavioral1
Sample
a473acd514a850165712078ec49ba3b4_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a473acd514a850165712078ec49ba3b4_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
a473acd514a850165712078ec49ba3b4_JaffaCakes118.exe
-
Size
373KB
-
MD5
a473acd514a850165712078ec49ba3b4
-
SHA1
45bda2f9f957dbb0da9a06f934facd9d17fb8f86
-
SHA256
9f67cea814388754884dfa2778d0169136da473091ab3285b9f9ca444d5cc59e
-
SHA512
03c5e20d9e9ba6d21e871a6e2f51ef3043e002656dbf50c6904c4908ae88fd4ae4901c282a3548f8f930f2bc0958c457de544a707f1f830cd1bd0a404bac051a
-
SSDEEP
6144:SGkORa/mgnQXgZG9PvK6pu4Dx0DrQlqK3BvN+Vz1dbroBjQmafsQQRwbreMnnYJ:WOmmgnQb9K6pVD+QEK3BvN+mjQmafsQE
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
pid Process 1728 a473acd514a850165712078ec49ba3b4_JaffaCakes118.exe 1728 a473acd514a850165712078ec49ba3b4_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main a473acd514a850165712078ec49ba3b4_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1728 a473acd514a850165712078ec49ba3b4_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1728 a473acd514a850165712078ec49ba3b4_JaffaCakes118.exe 1728 a473acd514a850165712078ec49ba3b4_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a473acd514a850165712078ec49ba3b4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a473acd514a850165712078ec49ba3b4_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1728
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
267KB
MD550d7a4da5f1a4f2999b0178ccec1320d
SHA1443d543e7b8ffec0b84768728d38d8c285ec615f
SHA25628e40d56758faad7a04678a6a2628a10eaa8df9f63f49460a65d539262453245
SHA5120cdcb9e47db9e7c073381161386e9fddb19ab7848d456cbe26ab5ede44fd6ae04aab25c6dc438c458861651f1238e8ccb9976484c4d5e919cb25a5d52c165d7d