Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
-
submitted
20-06-2024 11:58
General
-
Target
05c792f7ca289a5e53d390b9f32ffcfd_JaffaCakes118.exe
-
Size
414KB
-
MD5
05c792f7ca289a5e53d390b9f32ffcfd
-
SHA1
6b97cc98029771ff5a7765360bf12561201b432e
-
SHA256
b4eea543d3c7a0d19f62b2f0dec0cb544f8d65cd3c8447298632110abbbcdabb
-
SHA512
6955f493830ba2591d3a961830e4ebb32d0e269cbe624f0e6e8a6288db049f072729e62f82c48d680eae83d33f1b888f6c5cb44ed39a15e25602343dc7b35dad
-
SSDEEP
12288:cEU3npqLuOCtLpq7vnGjp2Vofyr3t/Fwh0uZatfGRxSI:cEU3pqLXEUQ2VofyxFwh0N
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\05c792f7ca289a5e53d390b9f32ffcfd_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\05c792f7ca289a5e53d390b9f32ffcfd_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\nH13201LkNaP13201\nH13201LkNaP13201.exe"C:\ProgramData\nH13201LkNaP13201\nH13201LkNaP13201.exe" "C:\Users\Admin\AppData\Local\Temp\05c792f7ca289a5e53d390b9f32ffcfd_JaffaCakes118.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
208B
MD536d721d117893df30030f81cbee2428b
SHA1db5b144ca795aa54c615b598b58a8b18dedc2a0a
SHA256bc11c5ffde14bbf392fce425b0e95676f06cdf14748942764693e9ae898eebb0
SHA51259e75b88e018708ed66458b212ff5a39b26f2aae6154d7833d6f8fff4b576d711dae9fa62b587e938aa176022cb335330c8ec84920c6477864a128a834e613ce
-
Filesize
414KB
MD5827f6049925b99e8d6332453195be689
SHA196e6f62df6a6189fe340e91a349994c3d767d5de
SHA256315c2901ae9635be64a5904a97833167d4ce3c194ae5921df567cfc8309b3c4f
SHA512f9d6334e8560c368bfcf50f1afd0ac701b9001903e299ef4e96b3223d881c9b3a3509757338c3876c397d393009623837bdae72cf0c30d0bd6a458969054855a
-
Filesize
840KB
-
Filesize
840KB
-
Filesize
840KB
-
Filesize
12KB
-
Filesize
840KB
-
Filesize
840KB
-
Filesize
840KB