Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
10-08-2024 05:29
General
-
Target
84f43389866cb5b26de8d0768b977501_JaffaCakes118.exe
-
Size
137KB
-
MD5
84f43389866cb5b26de8d0768b977501
-
SHA1
d22164b6b0a60a2dd87c123df768ba91b4ac6cfd
-
SHA256
bf5ae83cae9a624f06ef2b6df13b042c51c35fb9a76a7c489f3b291c337ffc04
-
SHA512
714f2797fd77c4abafdd5001dbe9f8ca4095866945cd101aedd6997bf79a83782ef76256f35e40f7b3d0305600843c89e941697478d504136f7920a839dc8bbb
-
SSDEEP
3072:KUzAFO89eYdtw0i1ZHqSj9JDJ8k3QCLYCYo2vCiZqlWIkEocnbTJf:4Fr9NGHqSLDJ86QC0CR2a0sWIkWbT
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 6 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\84f43389866cb5b26de8d0768b977501_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\84f43389866cb5b26de8d0768b977501_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Vxylea.exeC:\Windows\Vxylea.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
372B
MD5748e6900aa7b2c1b092df04b0710124a
SHA1acac420fcf7ab409e73810c1f41f749d1281cb5e
SHA256539b10f4cdf2e0b9ce3b9cd0ee4c674f5420a5e8da2ab3b29605b34f541de67d
SHA5125112f2080da7e23b4308e521ed5fb4c4d1d4f108e5228d996cf374d7726da1f05e1054a4d035d436eae757a925ba8b4c3b78b94e17f889a49f7fa66abe54dd7f
-
Filesize
137KB
MD584f43389866cb5b26de8d0768b977501
SHA1d22164b6b0a60a2dd87c123df768ba91b4ac6cfd
SHA256bf5ae83cae9a624f06ef2b6df13b042c51c35fb9a76a7c489f3b291c337ffc04
SHA512714f2797fd77c4abafdd5001dbe9f8ca4095866945cd101aedd6997bf79a83782ef76256f35e40f7b3d0305600843c89e941697478d504136f7920a839dc8bbb
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
44KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
236KB
-
Filesize
236KB
-
Filesize
44KB
-
Filesize
236KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
232KB
-
Filesize
4KB