Analysis
-
max time kernel
140s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
01-08-2024 21:28
General
-
Target
81c96f910922c8c0219f4a323f963972_JaffaCakes118.exe
-
Size
872KB
-
MD5
81c96f910922c8c0219f4a323f963972
-
SHA1
476f6166743fb0ac5a2d487a2cb6758d6671a0a2
-
SHA256
b52796f499e7b4862db4abbba605cd32cbb2581016e67ad6dcc4c4ab078d1738
-
SHA512
fb1fc5e6b0d1dcc85d4cc2fcacabb77b23cfe05acc22ac62801b75b8c9c17186ca41c81272376981d1a72a77d19b43696238fab74dcbbec18adaacf53802059b
-
SSDEEP
24576:nchRlqUeapTMr94ci4zHgDwkVYEUROSe9SPsH4++nmoJI:nONpTMuxsQV5BSe9M1++nZI
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
-
ASPack v2.12-2.42 1 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Loads dropped DLL 3 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in System32 directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 35 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\81c96f910922c8c0219f4a323f963972_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\81c96f910922c8c0219f4a323f963972_JaffaCakes118.exe"1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
156KB
MD5787d18f0ffa2ae840a8ba4f9c5e14f20
SHA12eb2eaaf084c92c856fc22865cd85738d21c1ed0
SHA256d37256cc8b9063b483033455f6feaac0bfc5ce8a1688c4a6e167120909996bf0
SHA512e463dc5753af02d67173da653cec984d4f870f9c5d514b82d0300878fb0fbcbde1e4c65bea50031f4fe2d8146684d900d6defbfcbcaf0772a8c990e46e5b82ef
-
Filesize
80KB
MD5b8546d0c3a88077599a4c52eca3d5a97
SHA11470a09a892f798b75c10c0b165bd3e65ea432f8
SHA256c0d69587de55c79f0f4ea69e9fa62d35fb595a3fda406ed243035c5639158816
SHA51270fb099df16f3575604c4114e48ac54a8ec9ebd7b6008b7f5411b3b3a77ed6847c703a1fd0d00b145c3f41d7529e08ebd37791b261f2cd6aaaa51db21d121b07
-
Filesize
365KB
MD5ccb605b79a83cb1d2e2cfb94c49633b1
SHA1c531ed3a55c1a3ea3630e669aac448f1efb8f82c
SHA256beabb1a2bfbd2691bb94d9cad3a797080e473f7fbd9004a19d8cd14e23afb915
SHA51278d9bff0b2724a16c9c299152bc792c761d876dc7b17f3a4961106da0ed0f2c52a2455d7227a4894d5f4c527be0c7cf1226bc70a427be18e91f57ad6cd5051c2
-
Filesize
320KB
-
Filesize
913KB
-
Filesize
288KB
-
Filesize
600KB
-
Filesize
1.7MB
-
Filesize
320KB
-
Filesize
288KB
-
Filesize
913KB
-
Filesize
600KB
-
Filesize
1.7MB