Analysis
-
max time kernel
117s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
11-08-2024 19:47
General
-
Target
8bb89b15aa4f2899bf6a4e102919b690_JaffaCakes118.exe
-
Size
423KB
-
MD5
8bb89b15aa4f2899bf6a4e102919b690
-
SHA1
bf54ed3e850eccc3e86eb136cc5d2565d41fd635
-
SHA256
33f2ccd99744e413da6955ed048d96dcc451cbbb1aa38e4713510a6fbbb696dc
-
SHA512
a12f47b79573b301c0aecbfce8ed603dc3baa71c8ee5e7efb329b0c1f602e691ec3192b4d64e87a6cfb5caf4f92e2468f37372fb2a0bacaa226b28dd8c53b3e5
-
SSDEEP
12288:ZHLUMuiv9RgfSjAzRtygPI/MgVmCL94aQE:BtARPA/Mgp94tE
Score
7/10
Malware Config
Signatures
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of FindShellTrayWindow 4 IoCs
-
Suspicious use of SendNotifyMessage 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8bb89b15aa4f2899bf6a4e102919b690_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8bb89b15aa4f2899bf6a4e102919b690_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1012KB
-
Filesize
1012KB