Analysis
-
max time kernel
143s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
20/07/2024, 23:50
General
-
Target
607bb2277992a33164ff24a59eba8843_JaffaCakes118.exe
-
Size
351KB
-
MD5
607bb2277992a33164ff24a59eba8843
-
SHA1
8671951f1daf8cf67e096fc8c632facd675ef891
-
SHA256
805fd75e9bba5b32d3b5e0e4502bdba10431f01542d8d217f8550a35a56ad2f5
-
SHA512
ea31326aff0a2397afde12935367ac7f730088d9227e999f04c282c964aeee5c834f6302a27ac5201d7910297668ffa5f8bb15917d55a747672bd8b3cba8bee8
-
SSDEEP
3072:QqRAFgKD5iLDeZl/AtADljPzXbMrawgkeAubbixuB2MiOQHQRvOxop0o:QqKgmwfeZlVt7graw1uKoQwUn
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 6 IoCs
-
Program crash 1 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\607bb2277992a33164ff24a59eba8843_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\607bb2277992a33164ff24a59eba8843_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\Rkywia.exeC:\Windows\Rkywia.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1428 -s 7803⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1428 -ip 14281⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
351KB
MD5607bb2277992a33164ff24a59eba8843
SHA18671951f1daf8cf67e096fc8c632facd675ef891
SHA256805fd75e9bba5b32d3b5e0e4502bdba10431f01542d8d217f8550a35a56ad2f5
SHA512ea31326aff0a2397afde12935367ac7f730088d9227e999f04c282c964aeee5c834f6302a27ac5201d7910297668ffa5f8bb15917d55a747672bd8b3cba8bee8
-
Filesize
390B
MD5162926c1b7208f0032fab4b591107b99
SHA1e80a5d7ea0e2eb382bc0da05fa7d095a80e81416
SHA25663dbeda8b0c6fe68e4fac5fdb4a3a20d5876a7f402c5bffd8df7f3f0cc635eed
SHA5120a5fe153ecaac7ae054fb8d54759b4a66664185d77e96f3f61e0dbc07620346685ed88026586d1fc20dc63f3a661ca70e966c022398b75380537da9ea5d81db9
-
Filesize
360KB
-
Filesize
236KB
-
Filesize
184KB
-
Filesize
236KB
-
Filesize
360KB
-
Filesize
360KB
-
Filesize
236KB
-
Filesize
236KB
-
Filesize
184KB
-
Filesize
360KB
-
Filesize
4KB
-
Filesize
4KB