Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
17/08/2024, 23:20
General
-
Target
a48ce5438105cf62197d7347a571338d_JaffaCakes118.exe
-
Size
111KB
-
MD5
a48ce5438105cf62197d7347a571338d
-
SHA1
3e3c6b1dda526413d0b56d058cb01660ccb5e750
-
SHA256
6264e95e9124567cc7368a6420759fc15bac4b52d0babaee3ece46bf592cb597
-
SHA512
e2a1d6df9ccf80a1ada60046a76d2748b5f88cfe6596127dfaa633e12055d4dbcd72e165f1a03f41fdd739e0c1192f9410c05f1ede66c06b92279d32b7bbd827
-
SSDEEP
3072:8ClbnA+uZMSie/IdG8xAh5BPnnvbOm+tBjQehgCKs2MC:8GbnA+uZMS1IdG8xAhzXKnXQuXKs2P
Malware Config
Signatures
-
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
-
Deletes itself 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Kills process with taskkill 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a48ce5438105cf62197d7347a571338d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a48ce5438105cf62197d7347a571338d_JaffaCakes118.exe"1⤵
- Server Software Component: Terminal Services DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /t /im ZhuDongFangYu.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Deletes itself
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
345B
MD5513b721d4142399189cbc7b9916b7a25
SHA1f7c9252c44a890a61a9c0b448940a2663edcb403
SHA2565c9d7cb59f1a5345bf80fbb578847c2a921f781d12a58df097f8f4db7ca5bd8a
SHA5125dd32fc9e2219c314ad65665fd9e766c0a0e6c83eba49144fa2cb71cc0a0a99fc13f019854f331799a0f3ea09f308eb4f6e2258c80432847fbb9dee42e1c9ff3
-
Filesize
94KB
MD53cc1a18f670dda332c98816a1ee5d8db
SHA1156c4ce53f72b70c52ff45ccbe627aa9f596f286
SHA2565d78e8b3b091719965b0929e2dc0f74f2cd8625933274a4efcf22fb61dfc27ee
SHA512b3358538af0cce9f6a59ae81ae6d90cd8bf1ce04cb6e22a5a6c18fdd96df220fcdeacf96de1b9450b0972c3c05be9c2f583fd0180b68f89dd0f534ffd1bfed1a
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
116KB
-
Filesize
116KB