Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
11/07/2024, 20:39
General
-
Target
3aa351387b53449aba8d58f8e7e41e61_JaffaCakes118.exe
-
Size
496KB
-
MD5
3aa351387b53449aba8d58f8e7e41e61
-
SHA1
bbc04810199e233e0ee02c402e4af0771e89ff9e
-
SHA256
08c612b8bb61157ca05e3082389952286e19174ae0192a9d79b248d50bbcc146
-
SHA512
d42de8651536bda7f0e034a7435d3a9eb254ffa7341b7fc8e7eda886e6962dcc9b6909e9748f9d8ecd3e68b01c8e4a4fdbcca7f7d59c640d51e10e27ade2e119
-
SSDEEP
6144:WkPlSwSmzEnqjDWrzF/zUc7AeY6EJsObtbHxcLXnJELlZfzuNdKr+Q0:UzUgcFswbRoXnS6M
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 6 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3aa351387b53449aba8d58f8e7e41e61_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3aa351387b53449aba8d58f8e7e41e61_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Urimaa.exeC:\Windows\Urimaa.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
372B
MD50faa9015f722e2ba6b677340aacbab03
SHA18b254da402013840cf799e96b78bc80fe76c16b2
SHA256eeb9e914f59367c1e41db3cb5e1f3d38c7e06e679859ae1b36c66dbbc51e5d0c
SHA512250b0a1a19b1e0066ff569afecb949a9ee27f15c99f67c70bd7606af164d5f3be511c2c9189226f4977ca66853410c0b14cc6341b4682f5b3ee38e8c143cab57
-
Filesize
496KB
MD53aa351387b53449aba8d58f8e7e41e61
SHA1bbc04810199e233e0ee02c402e4af0771e89ff9e
SHA25608c612b8bb61157ca05e3082389952286e19174ae0192a9d79b248d50bbcc146
SHA512d42de8651536bda7f0e034a7435d3a9eb254ffa7341b7fc8e7eda886e6962dcc9b6909e9748f9d8ecd3e68b01c8e4a4fdbcca7f7d59c640d51e10e27ade2e119
-
Filesize
4KB
-
Filesize
228KB
-
Filesize
228KB
-
Filesize
228KB
-
Filesize
504KB
-
Filesize
504KB
-
Filesize
228KB
-
Filesize
504KB
-
Filesize
228KB
-
Filesize
228KB
-
Filesize
4KB