Analysis
-
max time kernel
141s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
10/08/2024, 08:22
General
-
Target
8567ee36595d0146e22e00fc86756292_JaffaCakes118.exe
-
Size
103KB
-
MD5
8567ee36595d0146e22e00fc86756292
-
SHA1
e42d386bb6a6259bb04d7adbabfea09b83fac0b0
-
SHA256
96b67484ae8d09b496c69e1f7023ebb74087a16558f2db5f79aa1efe8fa5a404
-
SHA512
a67cf423ed2efd43964bd97361e4267b796790c7821bf82b482d4a87d842c74aebe0f3a7b9ffb28805f5c1e2faed1b5c039be0d3bf34f11a008e252f058673e7
-
SSDEEP
3072:ZazlvWE9BJ3+ReJczpcw+Aka6LTuEzfGB7S2uWRg:WlOE9BLJWp1+Aka6LKEzfGB+eRg
Score
7/10
Malware Config
Signatures
-
UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in System32 directory 2 IoCs
-
Drops file in Windows directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 8 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8567ee36595d0146e22e00fc86756292_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8567ee36595d0146e22e00fc86756292_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
276KB
-
Filesize
4KB
-
Filesize
128KB
-
Filesize
276KB
-
Filesize
276KB
-
Filesize
220KB
-
Filesize
276KB
-
Filesize
220KB
-
Filesize
4KB
-
Filesize
276KB