Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
17/08/2024, 09:40
General
-
Target
a20bb0dd29cbf60a8e053bc84c580a63_JaffaCakes118.exe
-
Size
144KB
-
MD5
a20bb0dd29cbf60a8e053bc84c580a63
-
SHA1
c23048688dfb690a854c7b3bb28488be15c98f14
-
SHA256
19f0793a3cd247e0c25da4c4d675add6b59521c43811fd88d586fe2cc6506d0f
-
SHA512
c2281d5279ab732862d9ff9e4dfd981f2c5bba26746a2c262523eaf6d6e6cd0f376aa2f1981a2e5abfe58a21a3c2d3664d29824d8dd188535f725b16b9d56544
-
SSDEEP
3072:XKx8ZCyarZzpvjvHCs8iQ8wrBC3XltAXrBrB/nQZR2c:aicyKZzJvHCAQ8wM3XltAXrB9/nQZR2
Score
7/10
Malware Config
Signatures
-
UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a20bb0dd29cbf60a8e053bc84c580a63_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a20bb0dd29cbf60a8e053bc84c580a63_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
248KB
-
Filesize
4KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB