Analysis
-
max time kernel
150s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
13/08/2024, 15:31
General
-
Target
93ad51e981ec780c160976f39ddfdb09_JaffaCakes118.exe
-
Size
316KB
-
MD5
93ad51e981ec780c160976f39ddfdb09
-
SHA1
b7715896f82680740ff79ad6e14c6595bd06412c
-
SHA256
0f0bc195b7cff4eb9cac920045750229125f0ca23bf2723ac1c65b126c64b87f
-
SHA512
9783ed1a7d2ffca2083783faa1776ddab1c4b30f1b6dd7646c25b676894f4167c6d7863b3099e8364efc517a55d9ce0efca55eef883bdc4eab7ba30d25f7e38b
-
SSDEEP
6144:xhgMbyt+/lFO7UXdj5hcD28Ek5k+6GGv+H1wpZnjZr0J/x:xhgxtAA70R5uq89H6EHe3pUx
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 11 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\93ad51e981ec780c160976f39ddfdb09_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\93ad51e981ec780c160976f39ddfdb09_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\pFcMbCiHaLg17713\pFcMbCiHaLg17713.exe"C:\ProgramData\pFcMbCiHaLg17713\pFcMbCiHaLg17713.exe" "C:\Users\Admin\AppData\Local\Temp\93ad51e981ec780c160976f39ddfdb09_JaffaCakes118.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
316KB
MD5640dec5e43deeaf6434bca07b4006b5e
SHA11698b1891fa12d5c01cf9257efcdb27bef7418d2
SHA25698c7dc67a46c697d9f2a1287000b9e1649a64ffe73c453c9cd2f2809d8a3dee7
SHA51217fcc09f26aa7ea88f3e8ce74352651323ea3d7c2e04aad6f723624eb8eaa4e3b6e74753f93b1acdf8fdb2e3eea2da49d0f5854da96db3fb2e25311dd6d37eb7
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
4KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
4KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB