Analysis
-
max time kernel
136s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
10/08/2024, 08:07
General
-
Target
855d334b9455e8ff4356ae2dce5af92a_JaffaCakes118.exe
-
Size
639KB
-
MD5
855d334b9455e8ff4356ae2dce5af92a
-
SHA1
06615d4de2b5301407e081d373e2be214ea61446
-
SHA256
04ae9296b6eee98b80ddc664551cf4d4221bf074d96e10c3b1e66c146b33de18
-
SHA512
facb67098473b9baf45bb5b73af0841ee98050d7a030b2deb71adea00f97ba9e9096f94d2ff020753e21597e498fbf19195988ef4c7e16d1a995dea166d19b30
-
SSDEEP
12288:1449os5F770udmeiir0WFmEPF3Z4mxx7QaOMetSshdlsC3dw:qa5ddmfirf4SQmXSMeMshdtNw
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Drops file in System32 directory 3 IoCs
-
Drops file in Windows directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\855d334b9455e8ff4356ae2dce5af92a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\855d334b9455e8ff4356ae2dce5af92a_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\uninstal.bat2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\an.exeC:\Windows\SysWOW64\an.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
639KB
MD5855d334b9455e8ff4356ae2dce5af92a
SHA106615d4de2b5301407e081d373e2be214ea61446
SHA25604ae9296b6eee98b80ddc664551cf4d4221bf074d96e10c3b1e66c146b33de18
SHA512facb67098473b9baf45bb5b73af0841ee98050d7a030b2deb71adea00f97ba9e9096f94d2ff020753e21597e498fbf19195988ef4c7e16d1a995dea166d19b30
-
Filesize
218B
MD5545b8cb8f4ad56a11b84a3e389eca862
SHA1639c5848dc2d2cb19a81bfd1a37ae394f529dba1
SHA2567253e9aac9c820aafadfc8783e851f0cd9d786ef7a3bdb0f06d2f392297d6e03
SHA512ae4e4e58e7a2cb44f55e8ece962564864a6f06813bbc77bd2837b596d6ffcb83f5c0eee428d5f31ac9b7d26b9511c243649937e6fb08dfcdb74cb9bfb59a1361
-
Filesize
1.1MB
-
Filesize
336KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
12KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
336KB
-
Filesize
1.1MB