Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
23/07/2024, 02:02
General
-
Target
65b77dc9bcc299eb6c89b7a634c923d7_JaffaCakes118.exe
-
Size
409KB
-
MD5
65b77dc9bcc299eb6c89b7a634c923d7
-
SHA1
332deaaa6ffe33f5e7820a5d7ec9fd67e7b8395e
-
SHA256
24fc182e430c1d3e140af10bce14ca417f912dc93de5f2d5aeaaa9708b6a2623
-
SHA512
aeb4579f9f96cb3d4ce257558dbdf500c4ef192347952fae35bbb0c1f4fce470e5a1271d88fbc447482a7ddbb8dab85f5cfef2c620ed96c3af5f44759aa170d5
-
SSDEEP
12288:DA4goYcLbiCwhCXfVjIzU8F3Ug9DO7hzm9ubK3rrE4GWHG4:DAtcLECXpIz1F3Rk2304GW
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in Windows directory 4 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\65b77dc9bcc299eb6c89b7a634c923d7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\65b77dc9bcc299eb6c89b7a634c923d7_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Nxilua.exeC:\Windows\Nxilua.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
409KB
MD565b77dc9bcc299eb6c89b7a634c923d7
SHA1332deaaa6ffe33f5e7820a5d7ec9fd67e7b8395e
SHA25624fc182e430c1d3e140af10bce14ca417f912dc93de5f2d5aeaaa9708b6a2623
SHA512aeb4579f9f96cb3d4ce257558dbdf500c4ef192347952fae35bbb0c1f4fce470e5a1271d88fbc447482a7ddbb8dab85f5cfef2c620ed96c3af5f44759aa170d5
-
Filesize
372B
MD5e3c19bce7e850449bf670e5fe85e60dd
SHA1c8d78a0e7adb7b5e46db9f2d5912b7589e6e01d0
SHA256e5a6fd3e41c09e803a31658c116e5b4ccd8a35fa06d4c45325ecebf8e324464d
SHA512b6e1e9c7402560a8312a4278a6481b4cc3ad115276c1d1f740f904bd63e61dfea174bd8064e66fbb52eadaead8df8d1182bccf1737edd332c1e7b59ad8c11a14
-
Filesize
416KB
-
Filesize
4KB
-
Filesize
232KB
-
Filesize
416KB
-
Filesize
416KB
-
Filesize
232KB
-
Filesize
416KB
-
Filesize
232KB
-
Filesize
232KB