Analysis
-
max time kernel
92s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
14-07-2024 17:55
General
-
Target
46e4976f5570addad52826c66edec222_JaffaCakes118.exe
-
Size
13KB
-
MD5
46e4976f5570addad52826c66edec222
-
SHA1
2af85b9f2501574128593e9dadd8483f61081759
-
SHA256
465dd302758a33b63ebfc61226e55cf60c6d81cd676f90604a0bf0d3cecb5349
-
SHA512
6388c32d690aec30273ce27c2f0b60ffc8234788c578582d9094fc02d8e2fae36d17e7205ecb26dce2b896f6d7a737bcdd191204778783c1e08c74fdcb8a845c
-
SSDEEP
384:ZZ95LUF9TZju4fZ3ZK9E/a6rQQIZEhOqT:TLUF52hEIZEV
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in System32 directory 3 IoCs
-
Drops file in Windows directory 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\46e4976f5570addad52826c66edec222_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\46e4976f5570addad52826c66edec222_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ctm03003.exeC:\Windows\system32\ctm03003.exe C:\Windows\fonts\ComRes.dll ins C:\Users\Admin\AppData\Local\Temp\46e4976f5570addad52826c66edec222_JaffaCakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60KB
MD5889b99c52a60dd49227c5e485a016679
SHA18fa889e456aa646a4d0a4349977430ce5fa5e2d7
SHA2566cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
SHA51208933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641
-
Filesize
12KB
MD5287665cb75c0b726bc5f0bb5ba443c95
SHA13df40a3e4bd397f59732f8bdd9643b63f352891b
SHA256a425ab312738adade00dcf8bd223e75a959c1ee0080577ea21f9905726705c5a
SHA512053e2a644314546910aecf84f95d4928b1dbce02d23b0282f83d2afe6ab98a40dc11a1c4004cefbd5a21820aa8fc8ad4602b9421fe6669850af806ed595172e8
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
92KB