Analysis
-
max time kernel
94s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
15-07-2024 22:58
General
-
Target
4bc67e561cfc81a9c2ffdeb885559971_JaffaCakes118.exe
-
Size
78KB
-
MD5
4bc67e561cfc81a9c2ffdeb885559971
-
SHA1
809a8248ad1314984a40b96a9c1431154d1c8758
-
SHA256
21060eb4b32339fe0f47b7d02f72cbdecdfbc4bf38572a0b3d6ed927c9c0108a
-
SHA512
ef00a75f4c696c21dae930ef966670de448100f28b467372f4a63c4a9055f398e6495ab6727cda73caafe2314c78fafd5804a0427df8f137c78787f6bc42c459
-
SSDEEP
768:bMvmdWDVvSxCC2qNDofMfQ4Uvwqs7SqjnbcuyD7UbMvmd63:otVvjqNDofMfQ4UvwJ7Fjnouy8o1
Score
10/10
Malware Config
Extracted
Family
latentbot
C2
atualizador.zapto.org
Signatures
-
LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
-
Drops startup file 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4bc67e561cfc81a9c2ffdeb885559971_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4bc67e561cfc81a9c2ffdeb885559971_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
84KB
-
Filesize
84KB