Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
-
submitted
25/06/2024, 18:01
General
-
Target
0f03f8c99e8a1c9f79799bd7ae0b4aaf_JaffaCakes118.exe
-
Size
392KB
-
MD5
0f03f8c99e8a1c9f79799bd7ae0b4aaf
-
SHA1
48bfd094207de116f578a7340f5804607556ce14
-
SHA256
bc2e18feb6393eaf30cd03cda9bd9f00ca431b4124ed3791612c6e2d620d1799
-
SHA512
1de3e4ff3aa152d74e1e943312b4f793549dc1bc9e2a81177d91995489cf7dc20031e7e0d1684022c38c06b0298bcbc40a23958dca2853f2ce2a44ef6aa9dc67
-
SSDEEP
6144:Ti1TOUzVPilUt6tE/K2fa7/3bCd9iPv9USgzUIHdbTuLC42DpFJ5FgzEx:T2TOQilUtZKwgvbQiP9cl4OJXgK
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f03f8c99e8a1c9f79799bd7ae0b4aaf_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0f03f8c99e8a1c9f79799bd7ae0b4aaf_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\bI06511IjDaD06511\bI06511IjDaD06511.exe"C:\ProgramData\bI06511IjDaD06511\bI06511IjDaD06511.exe" "C:\Users\Admin\AppData\Local\Temp\0f03f8c99e8a1c9f79799bd7ae0b4aaf_JaffaCakes118.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192B
MD56cea244d6f9892e75bf1e63fa73c06d4
SHA161520c65d7c2d0d179959df9edad30a8ef72a5d6
SHA2566d3d315b44eeac4f22dfffb17e5b1052c2dc20d4a7165808488844d950ca6da8
SHA512b36f0f8cd7205f1467224dac8b3639d904705735844183d88537f6f4796db8ca685718ee7aedca5b6c3416ec544bce2edaac4a2027b682931a08f56be368bb5e
-
Filesize
392KB
MD5eb0bdf00a751b89f14b68d5c57922203
SHA15e24ea2a6efd90e8650fd2bc6f39ae989a14a115
SHA256d37a27decf4e3aee931121253872a3c02142268b71c51e557dba89f7fe91ea57
SHA512a25050306631caa0ec8ea1aaf2553b025d9fa6a746d204dac0ac70b9079fce575ab24bb933edcec49ce0438e9fb447efd94ea5d43b3438bd5acc4708247f1ac9
-
Filesize
12KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB