Analysis
-
max time kernel
150s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
12/07/2024, 22:32
General
-
Target
3f223a9be3fcd02823da6b48a9307f3b_JaffaCakes118.exe
-
Size
392KB
-
MD5
3f223a9be3fcd02823da6b48a9307f3b
-
SHA1
eb9f0927faeaa3e3ee3ac74da633487bd92a6b20
-
SHA256
32a11fc47f4802702284ed73f898c410d5d3f557e9b24722994d7f540d1eac74
-
SHA512
ce9ed11891a4e469371b85352ff47fc0a63b05b4f0c8157e5d238a1f6d57f66ba5c4dba9ca6dd5ce5ab7264b4a4a381638f45208fa71f770a2dd3a92cb70fce2
-
SSDEEP
12288:ByUxBdqZO4QtjKwpN6MFtojYVS14x1mgpdJB9g:BnttrL6Mo0UE1ZdJB6
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f223a9be3fcd02823da6b48a9307f3b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3f223a9be3fcd02823da6b48a9307f3b_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\kB06511JnFhD06511\kB06511JnFhD06511.exe"C:\ProgramData\kB06511JnFhD06511\kB06511JnFhD06511.exe" "C:\Users\Admin\AppData\Local\Temp\3f223a9be3fcd02823da6b48a9307f3b_JaffaCakes118.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192B
MD5acd914851bc23c6457f34271c13730e9
SHA11bdc5a8d4c5e6509191ee50ce496e2d53476c36b
SHA25687f34cc13c9ced503d1533ce023eb8401a790fa8dc3f66920fa681fab1348fbb
SHA512fd962257e8cf1af365b62208d8523537b9713ff87b53f1b288b4b173778433a0af771156226bd80b835a1916818d359cb5fecd59233f9f18af7f8176ef6c61ae
-
Filesize
392KB
MD5b9a04724e01bf6f93c9d0564c40ec5d8
SHA165c306cef5be63b779d35ecf36f696a6b4f1bd24
SHA256467acb179a94325b641281dc39a3b209ea536a43203ba0f1e0e7642ce486a075
SHA512a76ca146f4963901928a9f38905b4b95868f5ea024501a72458069b82f58440226357a66a9a0093ea371921a195cdaf92dc486ecb3b62243d33586dba51c7c74
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
12KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB