Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
25/07/2024, 09:23
General
-
Target
6eff96a452490b7acf916b7565183587_JaffaCakes118.exe
-
Size
363KB
-
MD5
6eff96a452490b7acf916b7565183587
-
SHA1
c4bfc654dbbc3425eb4b93684011bddfe6c789b0
-
SHA256
f35efe3d22197ea8df0517d1e9a475c0061d7b8c04b0ad825c8880a32ee0f595
-
SHA512
f8a9c73bf8b000085ae3fe2f3a181b3fa6f31a8a93c0a389117af0050382930a19e493b8703286b7c42e3b91be5f02d6c8e170823e3d21eefa41143f60c446bf
-
SSDEEP
6144:5nF2idZecnl20lHRxp3giDZEEXldbmRpPba0rQEIhtFnPdbeiXZJ:nF3Z4mxx0E1dbEzLrsthPRXH
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
-
Server Software Component: Terminal Services DLL 1 TTPs 6 IoCs
-
Deletes itself 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Drops file in System32 directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: LoadsDriver 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6eff96a452490b7acf916b7565183587_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6eff96a452490b7acf916b7565183587_JaffaCakes118.exe"1⤵
- Drops file in Drivers directory
- Server Software Component: Terminal Services DLL
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k zphbal1⤵
- Server Software Component: Terminal Services DLL
- Deletes itself
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
59KB
MD5f30073a462983eda42432893c84a439e
SHA1409b7d7de68cd69ea7ec973c38057ecfb1c5bb18
SHA256162a64bbadfc36f36659ad0903c0d4709d55538a3d770e416e414c61ce58f8d3
SHA512c4b707767280ec21816c5cdf6128ffd1501c32986a6375d30efab4a9f1ffcf5d02aa6eea345f6bd7da5e86d848fba9486968264d5be375bec6fd8594b689f2d8
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
336KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
344KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
336KB
-
Filesize
344KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB