Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
13/07/2024, 21:59
General
-
Target
438121c72fed1f020a1fd216f9dd7806_JaffaCakes118.exe
-
Size
490KB
-
MD5
438121c72fed1f020a1fd216f9dd7806
-
SHA1
fe392e8f5ba50ff4fd9704056e52d06e4e21c074
-
SHA256
a5defc75f6530072504b03d4fd6b3ed5d0ea02aab9efdc74d2e28af58353bfc1
-
SHA512
baeef3cfdfdf3695ecd675c6b18713874865a94e24b2b3db8581470d9e7aa242c0d351fc2334562451fad2f90c6a4c12a35ac80bcca7874cae87e1a85c0faf9d
-
SSDEEP
6144:6xGIi+Q5RBvHyBnk3o83xbNlMEnFqbFuk+4xoFltJ:PdmnkRlMkFqpukhav
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in Windows directory 4 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\438121c72fed1f020a1fd216f9dd7806_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\438121c72fed1f020a1fd216f9dd7806_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Tqoxua.exeC:\Windows\Tqoxua.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
372B
MD5c17a4955fd61fb6e7f163a5456530cb0
SHA1c6cba7a60a6acd1e89fe0807038e1f8d168a865f
SHA25699484eaa636317330cb2c987b1346736f378baeed8e5f0f7ffc648168efd40e1
SHA512d0c3a93dab255526ff1f9fbf627c803ce885ff2d23c38383f694fe49122c6707c9158675624fc54ec69ab7a2e9370744041a1f267539e96e330da493518e7e2f
-
Filesize
490KB
MD5438121c72fed1f020a1fd216f9dd7806
SHA1fe392e8f5ba50ff4fd9704056e52d06e4e21c074
SHA256a5defc75f6530072504b03d4fd6b3ed5d0ea02aab9efdc74d2e28af58353bfc1
SHA512baeef3cfdfdf3695ecd675c6b18713874865a94e24b2b3db8581470d9e7aa242c0d351fc2334562451fad2f90c6a4c12a35ac80bcca7874cae87e1a85c0faf9d
-
Filesize
228KB
-
Filesize
228KB
-
Filesize
1024KB
-
Filesize
496KB
-
Filesize
1024KB
-
Filesize
4KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
4KB
-
Filesize
496KB
-
Filesize
228KB
-
Filesize
496KB
-
Filesize
228KB
-
Filesize
228KB