Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
19-07-2024 06:18
General
-
Target
5ac850c166ae3c886905e9000efd80df_JaffaCakes118.exe
-
Size
495KB
-
MD5
5ac850c166ae3c886905e9000efd80df
-
SHA1
6621b2992d7b7701abd4aaa379f30b174203937f
-
SHA256
dce0bbebc5caa6cc70c57f0c2f49a6a0714f0ca62b84af0d6a46004c28b13be7
-
SHA512
8aa135b15268e07e049f2ab05d7bfbc834cf47505ae300ed54d6ccc27a489b2872fb56ca868bfed6c54513718fb305b6f9a0d5414db68c909f7463c8f08a563c
-
SSDEEP
12288:90J+JAS1pELkD9lUE3hQJXFuwZbFBCSImFLxsDWKTWneoS:l7PE4DN3hQdtFB9LqDWK
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 10 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5ac850c166ae3c886905e9000efd80df_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5ac850c166ae3c886905e9000efd80df_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\dB42900HoCdB42900\dB42900HoCdB42900.exe"C:\ProgramData\dB42900HoCdB42900\dB42900HoCdB42900.exe" "C:\Users\Admin\AppData\Local\Temp\5ac850c166ae3c886905e9000efd80df_JaffaCakes118.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192B
MD5d828a08f319eb652f6e706e52e998570
SHA1071a95db82abe3ce8c766d4c60aa4ae35f328cf3
SHA25688c4104d94f8f4f46145e3009ab1a3581dd337b640f15bdc41bc730d124b7fd6
SHA512834a3e00cdad7212d66f797bfd1ed3c72ec0b58e127b40807fbec3ba142894d10ac782a3d6d690ffe2fbc4bd8012ce1bdddc88834b3f63a412578868f938d5b9
-
Filesize
495KB
MD5873c39154e32b29da0175e64e7bbe00a
SHA137f0d9eba3e2118ea21b3d65577b2883e3f1e7de
SHA2563dd77db6b69d4b87b5093feea5ab6dca85b92b95e77e091fd36723cb6ff4d396
SHA51241b0fb10f9ee1002b30812a50b9e0c1bcae407688b040c17be9fc9b2bb78301034b5fd264c981bb2a81500bebe65728fea30ccfd647747d0c03c0d98f52288c3
-
Filesize
800KB
-
Filesize
764KB
-
Filesize
332KB
-
Filesize
800KB
-
Filesize
660KB
-
Filesize
764KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB