Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
09/07/2024, 12:07
General
-
Target
304f17a96039e61362155031cbb64244_JaffaCakes118.exe
-
Size
57KB
-
MD5
304f17a96039e61362155031cbb64244
-
SHA1
ff64bb4d3db0ce7e6183f0f73c5012dbf9220574
-
SHA256
178ad46ac357753f81c79bb9b7a9b715550569964cce2f697abb69aac857e337
-
SHA512
cedec0258b2f7e420cf297455a676e926f80d8df6f54c530fbabc1631ca92847e40142a99e73dc5dba574aadd717339e279d205578f4d18b37e68eb6e8f80cff
-
SSDEEP
768:1N8AxVm91xBPevhfQJGtizVEH2kCkOJ/2EeiUN97tY2/:1L0v8vCotipEH2WWSjN/
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 4 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\304f17a96039e61362155031cbb64244_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\304f17a96039e61362155031cbb64244_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explore3.exeC:\Windows\system32\explore3.exe C:\Users\Admin\AppData\Local\Temp\304f17a96039e61362155031cbb64244_JaffaCakes118.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
57KB
MD5304f17a96039e61362155031cbb64244
SHA1ff64bb4d3db0ce7e6183f0f73c5012dbf9220574
SHA256178ad46ac357753f81c79bb9b7a9b715550569964cce2f697abb69aac857e337
SHA512cedec0258b2f7e420cf297455a676e926f80d8df6f54c530fbabc1631ca92847e40142a99e73dc5dba574aadd717339e279d205578f4d18b37e68eb6e8f80cff
-
Filesize
132KB
-
Filesize
40KB
-
Filesize
256KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB