Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
17/08/2024, 00:41
General
-
Target
a09032fb694604f267be0a3d5e90ea56_JaffaCakes118.exe
-
Size
714KB
-
MD5
a09032fb694604f267be0a3d5e90ea56
-
SHA1
919845b265ab4cae1386379a568c22436d5c976d
-
SHA256
126bc24548edb1f0655ad42ece949327ca12cfc558f8c0877bbc74926bb331e8
-
SHA512
57d3dc4ddef871586da1f912aebaf18a5394f601dfda3338d808ce223083aa48cdc96f2cb488bfa37c84dfa400121c79a866dd41d9f765de5d30a08024a38095
-
SSDEEP
12288:kaaxdDkR9Fh6vBkDsROnRJGGgtzHVmTIAe19g94HPPFpPPfluv8gP:1aDDkRDCkKO5gZVzACa94vXPfl3gP
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
UPX packed file 16 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 7 IoCs
-
Suspicious use of SendNotifyMessage 7 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a09032fb694604f267be0a3d5e90ea56_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a09032fb694604f267be0a3d5e90ea56_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\jsdfgs.bat2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
221B
MD5c7afa8e5b8f6e11b89e2b86678c7e46c
SHA199ea50d912b41d53293467740017dcee15b5224c
SHA256dbd201af157790247bd54238b88e7f46bd004a40fef522f3e2f1448ac4508d37
SHA51205cf274e193ce68d70bf33a47d297892b6cf995d4c6abb9f86f76b052e57e0cf774912ea69b3dc82125d12e1c28b438488a7a47d49c0f52c8bc402ab8923050b
-
Filesize
3.9MB
-
Filesize
3.9MB
-
Filesize
3.9MB
-
Filesize
4KB
-
Filesize
3.9MB
-
Filesize
3.9MB
-
Filesize
3.9MB
-
Filesize
3.9MB
-
Filesize
4KB
-
Filesize
3.9MB
-
Filesize
3.9MB
-
Filesize
3.9MB
-
Filesize
3.9MB
-
Filesize
3.9MB
-
Filesize
3.9MB
-
Filesize
3.9MB
-
Filesize
3.9MB
-
Filesize
3.9MB