Analysis
-
max time kernel
139s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
06-07-2024 06:01
General
-
Target
277ae8c6adfc27d8ed304a17977b4577_JaffaCakes118.exe
-
Size
386KB
-
MD5
277ae8c6adfc27d8ed304a17977b4577
-
SHA1
db2b0d56f5425ef1c35accd0c44d377176171f4d
-
SHA256
a2e3f9f1ff70e9d48bd7a72b7c6e596c92fe2287cf8dde165154ce6e6837c2f5
-
SHA512
c203e4610ec4ab218dddaa64feaee21bb7a90785cf0015f4eb925bcee2e0dfba9732e1486f81c74008198cc05351bbde7ce4473d05e23f4dc9d08331d009eeec
-
SSDEEP
6144:iCHDKhB0WCqB7l+04YmQ71poL5Cgg2GaSppsBUdZeppRSA6G7F3tNyu:tHmhW4BxXmQ71pkCg2aSoaISAxPL
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 5 IoCs
-
Suspicious use of SendNotifyMessage 5 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\277ae8c6adfc27d8ed304a17977b4577_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\277ae8c6adfc27d8ed304a17977b4577_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\mL13602BmEiF13602\mL13602BmEiF13602.exe"C:\ProgramData\mL13602BmEiF13602\mL13602BmEiF13602.exe" "C:\Users\Admin\AppData\Local\Temp\277ae8c6adfc27d8ed304a17977b4577_JaffaCakes118.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
208B
MD544c11cb5a00e4a63637e6b5bf92c4ce0
SHA17afa70f1c6baddd6726e705d75cc0d0ffa4cfda8
SHA256572806b8aa68030b4474cf2071f51ce640a687aec719fa53ba55171a87596d21
SHA5124d179dba87879a064144ecf384d56d8c9c4b772ac97592eb9939280003466610a32434736a59aededfefd1a8a745285fdfd42185b7ce4c70091302558da5969c
-
Filesize
386KB
MD5ef846d8a44057d9c97f5c4051cac1133
SHA11b13e6808697c704bbbd21d0a25aaa6bc19b15ca
SHA2563c38f4e8126e64b856f3665bf3b0e1f65f97c23df5801b4338c9b046e68889b3
SHA5121324793691a65a935f4d75badb033bbf8d3939bcec7d9daf28d4b82d7034dc4d4655f3176b93b9e2bf462ac54c5e0ba578874f3a62310cefcacb5a9636077078
-
Filesize
12KB
-
Filesize
828KB
-
Filesize
4KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB