Analysis
-
max time kernel
141s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
14/08/2024, 16:19
General
-
Target
96c4a894b6769ab3ed480965f5d6c6e5_JaffaCakes118.exe
-
Size
355KB
-
MD5
96c4a894b6769ab3ed480965f5d6c6e5
-
SHA1
0d926647ec04438ef50779afaff8540332fc8f21
-
SHA256
98b2d7cba5a07e548e5340367d4c65b8e815f88eb7a943ce4bd04319b938d172
-
SHA512
a31af828fcb12ab1df45b1d4d4306260f3a7c8ffe82c59b90143d660618677071be92fb3d279d70e3bbf6ace59fa472f5d74b79b3465308ecc8a83b55c8f9789
-
SSDEEP
6144:K3EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9EiS:VmWhND9yJz+b1FcMLmp2ATTSsdS
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\96c4a894b6769ab3ed480965f5d6c6e5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\96c4a894b6769ab3ed480965f5d6c6e5_JaffaCakes118.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD550e3dc8db00eadbf3da01d64acf88c98
SHA1d6292dfa0a060487a0cd9b9b3d1a517e92bb16dc
SHA256e15ccd88f0b7204441a2c258866a8a881136878c144029e68e7e8833f77dd75c
SHA5127efe8952ad2dce902e3e2141d2444bc8ce8cc6c8e95c99b4d48be7188b7b536308bc0f402ce2ca07d5d34f14fd9715a19d4407b7c22e416a670342f6bd1bf79c
-
Filesize
481B
MD558aaaeef7d5944f46a08e52e95cded5a
SHA1a6c58a894a757f5500ee7a759751a22003a552ab
SHA256db82b5472b31d066cd92057d8fd05a8f8a3f228c8e4604b56ccd8c00513e4e4d
SHA51278d05da3eab852dfef197e0ceff4b3281f6681d3ed9518da16824c558be121836aa66d9c35dde27052d3fdf1d5855adc9d62e9cf719f953bed1c2296bc4eaae5
-
Filesize
355KB
MD559e4e402265d790dc39c5e089fdfb670
SHA1dda191333c02037d136d4739a8d5bc1f44fdca71
SHA2562a854ad372514054f94247bd17f8df4714a7df495dcf4d94c36eb67a4f49576f
SHA5126d8ca5b6a1b7699191ee3325fa08a50e6bea67a8a9212e3fd0e451688a53d3b59ec86ba4eeb8e9c2d8ef2b319bb4d7fb6bff449c97b47504bb1aa4305700be1c
-
Filesize
380KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB