Analysis
-
max time kernel
150s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
25/06/2024, 18:01
General
-
Target
0f03f8c99e8a1c9f79799bd7ae0b4aaf_JaffaCakes118.exe
-
Size
392KB
-
MD5
0f03f8c99e8a1c9f79799bd7ae0b4aaf
-
SHA1
48bfd094207de116f578a7340f5804607556ce14
-
SHA256
bc2e18feb6393eaf30cd03cda9bd9f00ca431b4124ed3791612c6e2d620d1799
-
SHA512
1de3e4ff3aa152d74e1e943312b4f793549dc1bc9e2a81177d91995489cf7dc20031e7e0d1684022c38c06b0298bcbc40a23958dca2853f2ce2a44ef6aa9dc67
-
SSDEEP
6144:Ti1TOUzVPilUt6tE/K2fa7/3bCd9iPv9USgzUIHdbTuLC42DpFJ5FgzEx:T2TOQilUtZKwgvbQiP9cl4OJXgK
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f03f8c99e8a1c9f79799bd7ae0b4aaf_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0f03f8c99e8a1c9f79799bd7ae0b4aaf_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\eA06511OeDdK06511\eA06511OeDdK06511.exe"C:\ProgramData\eA06511OeDdK06511\eA06511OeDdK06511.exe" "C:\Users\Admin\AppData\Local\Temp\0f03f8c99e8a1c9f79799bd7ae0b4aaf_JaffaCakes118.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192B
MD521dac863de3f845b63c93dca31e1f787
SHA12348290259adc1d3f7473822b1908c608e1a2d94
SHA25600201036ee4ae8865127be4fc6633ce9eecab2ed35b9f751159804f26656bba2
SHA5122f30b6471412e4edc2a434c6f179e948d3df6fe69e76c424a1eb596e41ae41be080ee851abb271325ab03cb3852434b6490fed1d371b41f573a47fad0c0ca599
-
Filesize
392KB
MD5879d61db3c59d5c33c36d7dd44b6e2e7
SHA114b4f4ce8e221950e41971f35ed69ec0e2d26bf5
SHA2564a2e36eadc9baadb6485eb79498daee18502c9d8ef0bf9581ce96bea20763ac3
SHA512e5d20b5ceb48e6b527b8e3ebca58cfceeb7b86a7c71abf062e11f4b2ab265c1d1b70420da63499c1ef749d83c89633ca971fe1370a34294e71b7e93d2b0eb34a
-
Filesize
12KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB