Analysis
-
max time kernel
9s -
max time network
10s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
10/08/2024, 07:41
Errors
General
-
Target
854f04529bea410af384d99ef3050825_JaffaCakes118.exe
-
Size
640KB
-
MD5
854f04529bea410af384d99ef3050825
-
SHA1
def513650fb7fe0ca60ee2c563070df1142f476b
-
SHA256
34c24bf56b0d8efdaf94ef5078c03b03ffe902c6ddc7a3198a8d8960f8f1a4c7
-
SHA512
cf13411ae7dd994b0bf4d75dd4bd89b8dc69d37549c739a2c5e5778e19e7064c822d25c35c8fa50321277c6fbeee57b1cef7d70464ac78e10f3926bffa33e1ca
-
SSDEEP
12288:mSTfI82pnXAUWtiGCJunILpuIBb1NSGCKiYP4tKjxVrx4wb5ADvpU6x1SHhCh7F6:VTf+pXATtDkBJNSYNdVrx/IBB1SHQV
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies data under HKEY_USERS 15 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\854f04529bea410af384d99ef3050825_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\854f04529bea410af384d99ef3050825_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa39b6855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
515B
MD57f7112e9c3de0d48e8198b74207b5c03
SHA1d8acfb4a14d3cb8279c39f9d18780aec261b627a
SHA256d4d5fb19b9a21aa609c5f91c35d3d9dcd4c62071769b332406cc23215bb66ee7
SHA5129bed65083205866140d3f70d217a19ba75a443a58554748eac5edebf62201b08edb70bef0a28997447878db151dad62d0849014515c2c4767654b625e03f0a7d
-
Filesize
500B
MD5212a6d2dbd5c89a3ffe47bcdd5b43504
SHA13cbc32e292fb3a29e7df59026839f435cfa0fda3
SHA256197afe35f7607e225fd49d829e4c28608441c3fd8ce209daa171df675611bbb2
SHA512b2ce9af36e1c07ebdeac12c20038b01a48eb728f8094ee25eafac6e8152049e02694f936783a2fe41d61312be74781b01b5f8553eb2f954becee428851189c3b
-
Filesize
694B
MD5175412ff945c4d15eb6cd3b393d130c2
SHA12c83768848611756b277579f55f7f3a40ebee103
SHA256f9b7e03583ee87205d7c7e9e10dd9d2dfc94415e63c05203fda70431423a5f03
SHA5125dab37093e665a9fab279a71f0057253ac6676d0796c9b8c6cb69b403e44a3fadf62c353bb96bbf494ad87115b8199b6ed18b522ecc3a075dbc62c9e73b830a6
-
Filesize
12KB
MD51bd1cb93fac0acc948d65c51ab5489b4
SHA164ff1ef70e25554de420ef5da917e710937c03e9
SHA2561183daa52f3ff1aab9aec0e23ec92d6185e601f77f6944501d6fe5b3598518a4
SHA51245c7edb9f74d39c972226be0e7bf0213cc417ae2a8c0536a3761dddd02a8c3b4df8b2f316bf88e5979fc0d1e732e7e9f686245318a1cb3e48f901ee0e0ee77d5
-
Filesize
1.5MB
-
Filesize
4KB
-
Filesize
1.5MB
