Analysis
-
max time kernel
100s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
03/07/2024, 07:47
General
-
Target
21966b15bbb4957362df4553e5d9c342_JaffaCakes118.exe
-
Size
502KB
-
MD5
21966b15bbb4957362df4553e5d9c342
-
SHA1
7f7fac5c779f1533ecab9b7642f5b773ec7effc7
-
SHA256
d2d4bd955a4207b39aee701613f9b28773d6e643842b100c7052825e82c7a47e
-
SHA512
42940fab792ce9fc669d3826b31d2f9fb34e2864c133d5230c703b1af601afe0e2cd8beaf90390bec8a2bcde802ca957c1e0715736eb485856bccc313591e697
-
SSDEEP
6144:Lp/bGrl1gl2y54R5k0gfNqQZatB1VzVYPjgxajb1DKr0qFdF+KjZaQMIhL:Lp/ul1glRuO8AatFzVYPjNjZKTFdx
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 6 IoCs
-
Program crash 1 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 56 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\21966b15bbb4957362df4553e5d9c342_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\21966b15bbb4957362df4553e5d9c342_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\Lcojia.exeC:\Windows\Lcojia.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2060 -s 9963⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2060 -ip 20601⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
502KB
MD521966b15bbb4957362df4553e5d9c342
SHA17f7fac5c779f1533ecab9b7642f5b773ec7effc7
SHA256d2d4bd955a4207b39aee701613f9b28773d6e643842b100c7052825e82c7a47e
SHA51242940fab792ce9fc669d3826b31d2f9fb34e2864c133d5230c703b1af601afe0e2cd8beaf90390bec8a2bcde802ca957c1e0715736eb485856bccc313591e697
-
Filesize
390B
MD553d216e8ac478d9943d83505f9202d65
SHA1ecd4e5dfd35e4a5ac918ac3bd4ec35c82aa67401
SHA2565d242361dfc98598b62876d45bf3382f16506ce9f7eff4633ab50057bbc276ad
SHA5122ba4163640d9c8c3308280c8ab578a76e2db9b97c95dec247fb427396bdff99d6a76531bac1e478755543bb303a8caee4a2123247a2471f00fb8acaa16e93c8c
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
4KB
-
Filesize
240KB
-
Filesize
508KB
-
Filesize
240KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
240KB