Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
16-07-2024 03:11
General
-
Target
4c90a4308f902e87cd423ce06fc917c2_JaffaCakes118.exe
-
Size
137KB
-
MD5
4c90a4308f902e87cd423ce06fc917c2
-
SHA1
e9ce764240ae0acf166e26917c40dd1bf0704983
-
SHA256
4a75c23e7f2c2ffcb488436e95fe2a99941e47b6f95c1628e13fa735fd00bbe5
-
SHA512
e5f5ea036f313d8fdb242a5151218a4db6bb0ecfdb15e6c243058ee97c665348fce955a02a01bb8aba4837852b8dd56fc3d03ddc18e0e12e9358cedf087ed839
-
SSDEEP
3072:utrUTOOAwmgu0mMBCWajxnE1bASCBLoz+qcfhUmoPT/:utrkhAn0msCjGASAqR
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in Windows directory 4 IoCs
-
Modifies Internet Explorer settings 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c90a4308f902e87cd423ce06fc917c2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4c90a4308f902e87cd423ce06fc917c2_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Nzygia.exeC:\Windows\Nzygia.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
137KB
MD54c90a4308f902e87cd423ce06fc917c2
SHA1e9ce764240ae0acf166e26917c40dd1bf0704983
SHA2564a75c23e7f2c2ffcb488436e95fe2a99941e47b6f95c1628e13fa735fd00bbe5
SHA512e5f5ea036f313d8fdb242a5151218a4db6bb0ecfdb15e6c243058ee97c665348fce955a02a01bb8aba4837852b8dd56fc3d03ddc18e0e12e9358cedf087ed839
-
Filesize
372B
MD590ba18692b6dcb38dac6fd087a3175f6
SHA1b8105cf517190f2f8fd5355c9bd4fc7539c36ede
SHA2563411b33be227d7ffd4599a8fed628de2f502a735c24d42a9277d9ef0f0b8caed
SHA512efd21a363d9d18e4a23b469752f0dbaec0263ab7178a7875e7939805bfa8b3058d5b8547f373e69ab452543f530e5fbfaf9a57121949b84a5f7ae3bc5bd05f68
-
Filesize
232KB
-
Filesize
4KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
236KB
-
Filesize
236KB
-
Filesize
236KB
-
Filesize
236KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
232KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
232KB
-
Filesize
236KB