Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
23-07-2024 05:24
General
-
Target
664d59e6abd751b006cf2df0e32600a4_JaffaCakes118.exe
-
Size
617KB
-
MD5
664d59e6abd751b006cf2df0e32600a4
-
SHA1
755f1163a7568f2bba4e397392c87ba480848deb
-
SHA256
a2d08018d13895342890f096ff1e072694910b8bedbef9e8b2463463599b4959
-
SHA512
089671de1bc60c980ea9ad43b8d066d2a3691e9ee396d185fe4fa4ae03cc844f77fd2fb8c7727127bd741b42f447bc6e04aa72adf3e2da70d28e83d919a72fb6
-
SSDEEP
6144:iiToL+5dbM74wLeQs6LpjzBWVDp6WqRQEB417STvM01XM/k9o+gluwtDQE/xGcQF:3ejlQwfNK55tSno
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 6 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\664d59e6abd751b006cf2df0e32600a4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\664d59e6abd751b006cf2df0e32600a4_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Pzimaa.exeC:\Windows\Pzimaa.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
617KB
MD5664d59e6abd751b006cf2df0e32600a4
SHA1755f1163a7568f2bba4e397392c87ba480848deb
SHA256a2d08018d13895342890f096ff1e072694910b8bedbef9e8b2463463599b4959
SHA512089671de1bc60c980ea9ad43b8d066d2a3691e9ee396d185fe4fa4ae03cc844f77fd2fb8c7727127bd741b42f447bc6e04aa72adf3e2da70d28e83d919a72fb6
-
Filesize
372B
MD5de68bb14460d9ca50c0f30208d40ee7f
SHA1ddd6701b4e90eddcaf71a73a0bc02a2bf39a79de
SHA2561a3df716c27bb7b95d3c6472b8db0a30d311a507ae0656eb447091a42e5770ad
SHA5125ce3a62c671e704f2480d017524da09f675fc57797fafa2d8a5b8c7310ef0f2b945e3a5700431b83f8e457c17dd542a5cee67177f0c058fb2cbaabcaa8b62a35
-
Filesize
232KB
-
Filesize
624KB
-
Filesize
232KB
-
Filesize
624KB
-
Filesize
4KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
232KB