Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
12-08-2024 03:32
General
-
Target
8d2479e39261746bd21bbb924b80fef7_JaffaCakes118.exe
-
Size
365KB
-
MD5
8d2479e39261746bd21bbb924b80fef7
-
SHA1
28b6d2bdf8bdcf2a149fd0d18cb27d135435f33d
-
SHA256
109a10095159ddde72ee87532625ef95ee16a5e0cd085fcf37f89966e36ebd78
-
SHA512
9890d68db8733237375c37485feaacfcf71b2ea77ad3af08475f6792faccb9611afa9ee66496409ed3f880f084137c4eddab2ad41705ec66e738187215441f7b
-
SSDEEP
6144:xxKNWOXPOumOhnHDAiUNfNAxOZ/kxjXrpRaPz6PcSTGtNFEQuZxJC:xwhhxDrUYxOZ/kxj7pRizAcCGPFEQAI
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 11 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8d2479e39261746bd21bbb924b80fef7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8d2479e39261746bd21bbb924b80fef7_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\lK31166KpJgK31166\lK31166KpJgK31166.exe"C:\ProgramData\lK31166KpJgK31166\lK31166KpJgK31166.exe" "C:\Users\Admin\AppData\Local\Temp\8d2479e39261746bd21bbb924b80fef7_JaffaCakes118.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
365KB
MD5657fc8a23aeb298604198a8323d5b3db
SHA141509644e6f7c4c57e998a62fcd2609c259036ca
SHA25672d725a220c94659c67f0b071f713b837f5d9e66a3fafe018a747cb489022faa
SHA5124dcbfe6545ab8240a25968ddabbfd7aa2842bc819ead71a727c1ba2fc251aea573cc4dec8ee33630b8454775939e2409471cc57ae8471b08d74d0c259951bad9
-
Filesize
836KB
-
Filesize
836KB
-
Filesize
836KB
-
Filesize
836KB
-
Filesize
836KB
-
Filesize
836KB
-
Filesize
836KB
-
Filesize
836KB
-
Filesize
836KB
-
Filesize
4KB
-
Filesize
836KB
-
Filesize
836KB