Analysis
-
max time kernel
117s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
26/07/2024, 18:45
General
-
Target
75446d5a8fcde92c3c564adf2cbc9750_JaffaCakes118.exe
-
Size
340KB
-
MD5
75446d5a8fcde92c3c564adf2cbc9750
-
SHA1
fa7168a39e7c43b315867883794c505a8410ec71
-
SHA256
a5d1501bb3991d6898699a59a464ccebb1f1551db5515091ff07e90463f5df64
-
SHA512
0cf544bb4c98f3f231b1ddf0f5344092104205fb52cc90c8f976f872ba7ab204d215bd2e1b08e6aa10db0501024c9347b557ef1f00bd2d3b2f2ea2a7fe0450c3
-
SSDEEP
6144:MdUFvsF2idZecnl20lHRxp3gxklt+jrg4Ehm4/9P1WlsLLhRxr8TMsc/hv6t:M+0F3Z4mxx+klIjtKmIP1WyLtnAQyt
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Drops file in System32 directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: LoadsDriver 64 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\75446d5a8fcde92c3c564adf2cbc9750_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\75446d5a8fcde92c3c564adf2cbc9750_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\delself.bat" "2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
198B
MD5df663b2c67a46797fb4be9db6f138f12
SHA11e7b860deb1c5bcfaccb7d27ea7df60c40f5f5ab
SHA25646898c909f86c588b6ec27383619567cf2e4e962340625f2ce40bdcaa1bfd7d8
SHA512e55b1a21b371b44d03dfb95ed4a27b979481886f7d182d6c9879f8738667507dd694a2ea2c8a559a56c291917e06a76f11cbd5d170c18a8338cbf0dcba6a81b3
-
Filesize
3KB
MD571c84ece7ab13e77c3bdde2ce1817fb8
SHA11bb57908180fa45eaa08a9beda9c963ba93b39e8
SHA2565c43e0bcf6f0ea28acb4a06c9528ece43b0a363f13175494e1aeb9c585da0f59
SHA512ea078e76f8a0a23b57bc2110b799729434332ffc4d55eff1501ec52eb41a34b00a204f5811f0882afbaf49db643b9824b59fb00ae9a669842280dcad03ed5380
-
Filesize
56B
MD57d2b5bb0c20aff2563a0d5dcd3b5632a
SHA11a4ac79f211b0e42a79d10fc94cfb5bc7dd26c0a
SHA256e0d6a8df5d9342eac8e3f943be9bc44d214fea5a91f4b46ed899196905521443
SHA512159579335fed32f30a519057c4a7b1944523e58769c8467491bbaf9682cb9c0b987520b5bc8c8f19c21d70a3f3cbc44ed9ddaa59a20b4b1229f66d5769f6f89b
-
Filesize
13KB
MD50b90a4f918bd5c27a1aadbe5e756101c
SHA14b13eb9e1e14c31ce6dba96333ec2ff098ef3671
SHA2567f6334daeb802212a944c9220a0a86733c5fe0fb908d5c0b34e280f509b4912b
SHA5121cdf9277eb06746a389e5cc0f8103d84018f0d5cf348c11d7b56913bd919334d02f299131d9158bd30277974785a792b97543b6d484196a4abad41e32673819b
-
Filesize
4KB
-
Filesize
336KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
364KB
-
Filesize
4KB
-
Filesize
104KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
104KB
-
Filesize
364KB