Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
25/07/2024, 08:49
General
-
Target
6ee452b7893df4763b386e5b1935f24d_JaffaCakes118.exe
-
Size
112KB
-
MD5
6ee452b7893df4763b386e5b1935f24d
-
SHA1
bdb11de01a85891b8973012c16219f31e0424123
-
SHA256
7a102b22e4a30bdc99ba2aac64dd9c6ca42dcf5e6e855da6b4fa1072c7a98e04
-
SHA512
3fc051ce2dd450d14080b9969e0138201b3d5c3173a7a1030e4e23b43ac9b79704a7b41cebf808405240cd21b3a79b8ff1ad438cfc2edfdaaf644e4662213fea
-
SSDEEP
1536:H9w1d3EDgIi4WLbnmqkN72G5qlAAhK/i/pBQTX21qZcIUoGFBf:dwd3EgT4WLbmx7Sldh2McQ6croGFBf
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 22 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6ee452b7893df4763b386e5b1935f24d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6ee452b7893df4763b386e5b1935f24d_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1