Analysis
-
max time kernel
150s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
08-07-2024 05:26
General
-
Target
2b22d8cf3b32f4f04ad72735bae08c7a_JaffaCakes118.exe
-
Size
19KB
-
MD5
2b22d8cf3b32f4f04ad72735bae08c7a
-
SHA1
41f416f29622090ea9f026f1bd931d1f3d48ee7b
-
SHA256
6c95559188f4ff978f6b74702c8ae021da7135a64b43967bdb246751fd07d274
-
SHA512
70fdbc1735eb28fe37df0d207678cf94ba7596d5d7b776adf6a74bca5c8193862bb6f35caacd86b12c66e3ba95e5e04c183c0b6668893d41253eabee5d9c13cd
-
SSDEEP
384:bZubIC9Fin5t1RdKthjjVRSs6hhfDtYev+9zOTsU:bobMtndmjzS7hhdWyTs
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b22d8cf3b32f4f04ad72735bae08c7a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2b22d8cf3b32f4f04ad72735bae08c7a_JaffaCakes118.exe"1⤵
- Adds policy Run key to start application
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\scm.exeC:\Users\Admin\AppData\Local\Temp\scm.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7KB
MD5edad9846f18dbc57f622d76a44c0ef94
SHA1574c1603f032cecde4c659253f68ab67934a7388
SHA2564bb466a3d9fcc532f309fd81f9cc779541d0d17a89574dbe546fac52717a932f
SHA5126b2211fc59549fa749572585391c71f53e0c0a43ddda28eb68c39eb15bc595a33b9e45b5c3778e74d90357c1b5cc2078fbe30ae7f22d6780129e6a61e5c546a4
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
32KB