Analysis
-
max time kernel
52s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
09/07/2024, 20:01
General
-
Target
31c71243beb4fd4025ea2350217fd162_JaffaCakes118.exe
-
Size
197KB
-
MD5
31c71243beb4fd4025ea2350217fd162
-
SHA1
0c46d10c70857ca33fbf1fc86e926f66613c9e9f
-
SHA256
b8fbe06f67bcc604d2b2ab45a8ec17b4add2d8afd4bd0caa8694eb6af1219dd6
-
SHA512
cd90e0780cbc1c64e327d127c934d0919e8848d4e6f9525e9085f13c09f4339639c199e8b0e8f08b8a804a4e589f427911bacbfe6d3636555ee90eb2f2f8af32
-
SSDEEP
3072:yF2SRGOYiDEah5u2606Tqa4esT/TCJCKEOcP5/9iIttyB2BSz:yF22ojRnqa3DkvOIiwR0
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in Windows directory 4 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\31c71243beb4fd4025ea2350217fd162_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\31c71243beb4fd4025ea2350217fd162_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Rlygea.exeC:\Windows\Rlygea.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
197KB
MD531c71243beb4fd4025ea2350217fd162
SHA10c46d10c70857ca33fbf1fc86e926f66613c9e9f
SHA256b8fbe06f67bcc604d2b2ab45a8ec17b4add2d8afd4bd0caa8694eb6af1219dd6
SHA512cd90e0780cbc1c64e327d127c934d0919e8848d4e6f9525e9085f13c09f4339639c199e8b0e8f08b8a804a4e589f427911bacbfe6d3636555ee90eb2f2f8af32
-
Filesize
372B
MD54dfc5f4615a6d2f16ea865728bccb0fd
SHA127b439272f4743f632af6a4f3592ced040239a45
SHA2562a879713d87e8ada4e251a2bfee9705a691a247bb649cabf9c6dbcdc81ad92be
SHA512e6b4273f6b4e2a2faa19a35aafc43c0ec1a652a9c572f3bf29ec5c58efa3c39069d5097783f86ef52d90cd11e1a0e35049c325ccabd548c6dc9b91d5a9d45184
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
4KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
432KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
232KB
-
Filesize
432KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB