Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
14/07/2024, 04:30
General
-
Target
444fcde06c51da930c899f1ee9f17ba9_JaffaCakes118.exe
-
Size
441KB
-
MD5
444fcde06c51da930c899f1ee9f17ba9
-
SHA1
4d6a9c0bb3376b8f4bbca11682aed3de1ae18339
-
SHA256
769e06d1d967348cd3dcb86cd0742ec420493158af8af82a0be516f9be83070b
-
SHA512
ad09985684357ecef89e9de248557c9ca389a71b2b8519d286656d7d528f449c472e16875d4b82cd6cf9d6dfd9830cbb6950c8fe7e6535b946870acae4a9f292
-
SSDEEP
6144:fPDnxPTlkTaZSgcGAVmFXxKW281uJrbufQHISpM+9IdUvzC+Uu+Rt4:fPDtEaZ4xVKMdIYlxph9CRt
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in Windows directory 4 IoCs
-
Modifies Internet Explorer settings 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\444fcde06c51da930c899f1ee9f17ba9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\444fcde06c51da930c899f1ee9f17ba9_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Uzizoa.exeC:\Windows\Uzizoa.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
372B
MD5d3b9b27fb62443afc39febbad5197bca
SHA1a97693e3df7525beedf552cd92436d8dbbb4bfc7
SHA256dc151e8bf132a056cf3ed282825f136d6060c399d97fdf87d47ddb7f25acec07
SHA512a766cfe907a0df6756cc11b0ae1236d4b2bb93270e0e870c754e169c2f5e799d9f2502a577eeaf99ca28d20e8440bde7f3bcae6188b3d2a362916c591fe7829d
-
Filesize
441KB
MD5444fcde06c51da930c899f1ee9f17ba9
SHA14d6a9c0bb3376b8f4bbca11682aed3de1ae18339
SHA256769e06d1d967348cd3dcb86cd0742ec420493158af8af82a0be516f9be83070b
SHA512ad09985684357ecef89e9de248557c9ca389a71b2b8519d286656d7d528f449c472e16875d4b82cd6cf9d6dfd9830cbb6950c8fe7e6535b946870acae4a9f292
-
Filesize
228KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
448KB
-
Filesize
228KB
-
Filesize
228KB
-
Filesize
228KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
228KB
-
Filesize
448KB
-
Filesize
448KB
-
Filesize
4KB
-
Filesize
228KB