Analysis
-
max time kernel
150s -
max time network
32s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
14-08-2024 09:04
General
-
Target
9570dfb4575cc4a10791add62e64de24_JaffaCakes118.exe
-
Size
463KB
-
MD5
9570dfb4575cc4a10791add62e64de24
-
SHA1
9ce4dfac5cd7a09114ea14817866d4ba3ac3073e
-
SHA256
0ac802d9bf8fc8365b4e018be3da13e1ec5f9fe4b57883c9d7875c64f9f354a5
-
SHA512
88c92d8059b92cab068d2a34bb3f3dd471f455cff14dfb6d776860c3fd4b8e5536694c5beebdcc8354f3f8158684b5402ce420dab5c7377d4c07fb0a92a3abcc
-
SSDEEP
12288:Zwax+LBZJT9Z99ljxPh0UsIF5DBIQ7GX74h:I9ZF9DfwrI/DBIQ7GXI
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 8 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9570dfb4575cc4a10791add62e64de24_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\9570dfb4575cc4a10791add62e64de24_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\cL28301KkKjN28301\cL28301KkKjN28301.exe"C:\ProgramData\cL28301KkKjN28301\cL28301KkKjN28301.exe" "C:\Users\Admin\AppData\Local\Temp\9570dfb4575cc4a10791add62e64de24_JaffaCakes118.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192B
MD570a04fefe1bf1278a60c53c69227d4f5
SHA11afe4939bbc6622841f9b4ceb6876793e7215dec
SHA2561ed42cfbd010fe21f7f170f1b91fc03d906d68c4b12e64aa38768978ed7a4c7d
SHA5129a8f609e86c5a7553e7cf321e4cb9dd5885b72db996c009b35538ece41237fc9dd4006a50df63d8a307c84c5ab0906324def42fa42cb87e4ef3943afb7d6fb52
-
Filesize
463KB
MD542d2b89555788f33a9dc0477c7096af2
SHA1818f51fa129462c53c8daef64ab9ceb64a801cad
SHA25626f26d0b5572b2aa7e8451b10b5144b0bf68349b40d82662022b7322c4138521
SHA512b85ef2f9487c132e26a087b1ea3777bad4529b40a63cc595af5105e33aef283892ae39474df97837be2a7d4e64f91034fa82fe1c9843620d2b26eeaa53ed43a4
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
772KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
772KB