Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
25/07/2024, 13:19
General
-
Target
6fbc1e912096e8ba36e28f2826d928d9_JaffaCakes118.exe
-
Size
212KB
-
MD5
6fbc1e912096e8ba36e28f2826d928d9
-
SHA1
255c6890eb15a39a7fefe495c473f8aa7ac22366
-
SHA256
8bed0e77a36c4e4aa5451d95e5f897ec2d446b278ad8b48f202e4a9c2d4aba40
-
SHA512
f6813c0f86de8086ab116d835a760b04ffcbe578f393a67f0b8932cec0b7f86d420fe82c36edbe7dde905b375365902f0ac22027ce6b90d175603983952c0454
-
SSDEEP
6144:U64VvSOAAAJiJQWwaEY+p55bV0f6RuI+7SqtoOPmEf/J0:U6AkAAcQWnEYEnbeXI+7SL
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in Windows directory 4 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6fbc1e912096e8ba36e28f2826d928d9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6fbc1e912096e8ba36e28f2826d928d9_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Rgusia.exeC:\Windows\Rgusia.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
212KB
MD56fbc1e912096e8ba36e28f2826d928d9
SHA1255c6890eb15a39a7fefe495c473f8aa7ac22366
SHA2568bed0e77a36c4e4aa5451d95e5f897ec2d446b278ad8b48f202e4a9c2d4aba40
SHA512f6813c0f86de8086ab116d835a760b04ffcbe578f393a67f0b8932cec0b7f86d420fe82c36edbe7dde905b375365902f0ac22027ce6b90d175603983952c0454
-
Filesize
372B
MD587528a2f45118fc0dea3b68c8242b336
SHA184920ca564d92cbf8fbb4c719d834185622a5c75
SHA2568e7e27ee8ca194ee0b309207cd1dcc7666b7fe9556230922387258801f30deea
SHA512e8d7c575f53d464eaa33fd37d21b94ad366236fc760d8d6a87af51eb887b9c88fc0026a012b5214f60c75b3bce5a5a655d125c21bfba8069dce4a60e34dc8b0a
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
504KB
-
Filesize
4KB
-
Filesize
232KB
-
Filesize
504KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
232KB
-
Filesize
504KB