Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
-
submitted
01-08-2024 20:49
General
-
Target
81c2445840214308d13785c24e737ff7_JaffaCakes118.exe
-
Size
369KB
-
MD5
81c2445840214308d13785c24e737ff7
-
SHA1
24d02c74438d95c3485e9fb4fff7622cd07f709e
-
SHA256
b34dcfc6c63b7e8879ff65e7ed393633f54605dcb72fcd3c8393441411308527
-
SHA512
619d5a2a4d9cd55685ae95caba4562889820a6363cb717cc536404e71691a149a77b3153f79bbce2634f60f7db66a3706c77042741d3dc2f276cc2e0447e398a
-
SSDEEP
6144:mnOA/LjmUc7HtR9BdQIddBc7s5EpXDegTMCB059inresJMrEyoErOofEvxR:mn/nmUcx5W+nc7c2zegTMCueeRrEyJbu
Malware Config
Signatures
-
Server Software Component: Terminal Services DLL 1 TTPs 6 IoCs
-
Deletes itself 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Drops file in System32 directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\81c2445840214308d13785c24e737ff7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\81c2445840214308d13785c24e737ff7_JaffaCakes118.exe"1⤵
- Server Software Component: Terminal Services DLL
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k fpstgl1⤵
- Server Software Component: Terminal Services DLL
- Deletes itself
- Loads dropped DLL
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
76KB
MD56fd9b2a2c5ff100443398834e5b16786
SHA1e967818b6a945e2d3e2cceb56f36f29667712feb
SHA25652d9e435a12efa01da9a067ac19f55ce248c076eebc30ac2251e97add88dfcb4
SHA51232b8374a2bb761820a63d8f9daeaf8af32dea4398b179e259d99a9e70fad2349403d716f55669beae7912e178d2920dd1398724613c8ec31346efd50becb4557
-
Filesize
696KB
-
Filesize
4KB
-
Filesize
336KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
336KB
-
Filesize
696KB