Analysis
-
max time kernel
121s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
14-08-2024 16:05
General
-
Target
96b8fd7cc3d49b6849e1942e1d51b7a9_JaffaCakes118.exe
-
Size
150KB
-
MD5
96b8fd7cc3d49b6849e1942e1d51b7a9
-
SHA1
ac0150de769560460357a6c0165d5b372b16ffc9
-
SHA256
e7be5cc158f73c59959d69f394c55f47bcff39b776ec77d841f322461ee5f909
-
SHA512
a2660f4860b4bb923652e9554d6b57c3dd09a9fa86e8dfa48930e9aeb1ac786e13ae1630426e8abecbc482e1db6def6581f6663c528934f3f973b0a8fa61abba
-
SSDEEP
3072:fBJ13gcd5rr126j0jhOQn2a86C/mZ/+5g2MLl3rmF5JOrnq3+65m8+Grhvaja76K:qcrhAjAQn2V4/cgHgPmqZ7cWz
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Drops desktop.ini file(s) 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 34 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\96b8fd7cc3d49b6849e1942e1d51b7a9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\96b8fd7cc3d49b6849e1942e1d51b7a9_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exe00000084*2⤵
- Deletes itself
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
52KB
MD5c7570a7e24b29ee04a48c2c99da2587b
SHA1b6e3635a8de44b1635e8d362ac131e14281feb24
SHA256717cd7661c09701ee39c505d8b604ea3dd6c1151ef18e7ed1cab3832552ac34b
SHA51257479d2f5386ace8cc5e5ed543e6ad2c2b7b58accc849807d804a8cf0d03080f328f7b42442422fa1483a01ad473ca302f9eca97b9eb24e699e22db56641c572
-
Filesize
2KB
MD5eda2ff987cae79f40f55e0c491b37555
SHA1abde5beab7e1994adc225ce93b3fe63277dd6634
SHA25624a74233075ae2659a9d7c2ec38c0d9f9d06cd6bc404373a546e81dc9c5baaad
SHA51202e6958e781014e0c53b4ccd18ea07c0543af6def29e0bc30ad03dc803974a28591b75b68d342d77d1c3ac378548668ec7f53e17296a0ca18145c71673689043
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
32KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
32KB
-
Filesize
100KB
-
Filesize
84KB
-
Filesize
100KB
-
Filesize
100KB
-
Filesize
272KB
-
Filesize
4KB
-
Filesize
272KB
-
Filesize
272KB
-
Filesize
272KB