Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
14-08-2024 11:39
General
-
Target
95f432aa7f2104f1acc02d1843c81694_JaffaCakes118.exe
-
Size
295KB
-
MD5
95f432aa7f2104f1acc02d1843c81694
-
SHA1
4ec46f7583acea88473ea9bff41876c3861410d0
-
SHA256
693f8570691799f05ec5e92dac6dcd69bd77bac571b3448bbecee5fcc8aa0b47
-
SHA512
69bd8c87c8eada1db5f63c2d6694897754ed26cb651bc611b23c44d64d0e878932ceb8c2abe7a5281179fc40a232fce0a2394dd17366553c7943b59e7d1a120c
-
SSDEEP
6144:6W8QcOWX/ZGw5jL3CDUm0+CUdwtoPoT0lvf9ePTNJM+0tqIKRQK:6bQZCAUdQGoPoTsvf8jatRKRF
Malware Config
Signatures
-
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
-
Loads dropped DLL 5 IoCs
-
UPX packed file 20 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in System32 directory 5 IoCs
-
Drops file in Program Files directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\95f432aa7f2104f1acc02d1843c81694_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\95f432aa7f2104f1acc02d1843c81694_JaffaCakes118.exe"1⤵
- Server Software Component: Terminal Services DLL
- Sets service image path in registry
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
248KB
MD5821608b1c75ea9c154301bed3faa0205
SHA1c5b8f6de4404f83a057a23016b40159a6d0bfc95
SHA256cc2e6db20dd8d311c9d7f4af576cd2f0c2102dd84ffe72da8a6bed3517bb13b4
SHA512a8cf029de921ce80faed2eb79f95f581624522ecee871ef40efe1007c906d07305b2a3d24492db0fcbb292412a8bce938cacddbd79f3bf4220ae13b83493e933
-
Filesize
7B
MD586cba2f71acfc6dae1dd3c992b8f3259
SHA1181eb1ff410b5850eb625ee8414bdd0a4dee1887
SHA25610f9c5a642bb9341ceb0db298830997371348f935b14b1d600844b4679674d57
SHA512cb80ef5093c1dc8f1c9f0485406039ba54ffb122dc387bac7fbf7115f752d2360fe35129e8df4b2327f4e6cacc5213d53f9f6b1ca08ec7a6822a1aff8678cd09
-
Filesize
15B
MD5c55ac53d1798011f9d4679e83b8904bc
SHA1469725bc0be6f247ba60137dc47d44978fa425dc
SHA25635abfd22ea96246f0ffadc1931f6b26d2fd236d768536521809a00b47fa94921
SHA51284f08b832f99eab7727739570d5fa16bdf90a3ba1acc78f892c5c1487cdcd6f34500ea93bdbf445d10487e25c42ceed19e63184d82922fabeb02469ee921a7f2
-
Filesize
98B
MD5170cd147c183a127bf4f358f4f07f7a2
SHA1d59c983f3176bf9f885adbb4f9d4ec979376f4a8
SHA256c65b6829df34e237b2839941b31fc700d80564f2f9890911614625fa60934c23
SHA512a71af0920d89d5ff33ffa46835d9ece764390ad134df9efdf034c8c053e259d0bee642ad64aa76eb3c8a3b898cac308f8a69794ef08c3bea55375e3b0c43efbd
-
Filesize
692KB
-
Filesize
692KB
-
Filesize
692KB
-
Filesize
692KB
-
Filesize
692KB
-
Filesize
692KB
-
Filesize
692KB
-
Filesize
692KB
-
Filesize
692KB
-
Filesize
692KB
-
Filesize
692KB
-
Filesize
692KB
-
Filesize
692KB
-
Filesize
692KB
-
Filesize
692KB
-
Filesize
692KB
-
Filesize
96KB
-
Filesize
692KB
-
Filesize
96KB
-
Filesize
692KB
-
Filesize
692KB