Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
18/08/2024, 17:49
General
-
Target
a79f2947edc9daf185253fdd3dee4f74_JaffaCakes118.exe
-
Size
117KB
-
MD5
a79f2947edc9daf185253fdd3dee4f74
-
SHA1
75abfcd09f0076697f58ccd02f3ed22f2e501cee
-
SHA256
725f6f3f86f718c4c170d09c687b9aef6e7caaceadf67230e1065197e0c3cc22
-
SHA512
c5d99453726dacd79ddbc1c57d67314aa1d68ac2d25990a576f5a3dfd1a65b2d163722450cbeb6097da6082269ec9828694a4fbc3a74d602344ccc045e2692a4
-
SSDEEP
1536:uzpoGDl31C8f6SOvaLzX+aXGrj9KABF9SPRFHquxMJOjvSaABsDAwvpKbKQ7LGuS:if6SOozOaXGrjdSP9EaA0ByKQ7Oj
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in Windows directory 4 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a79f2947edc9daf185253fdd3dee4f74_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a79f2947edc9daf185253fdd3dee4f74_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Windows\Fqobua.exeC:\Windows\Fqobua.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
117KB
MD5a79f2947edc9daf185253fdd3dee4f74
SHA175abfcd09f0076697f58ccd02f3ed22f2e501cee
SHA256725f6f3f86f718c4c170d09c687b9aef6e7caaceadf67230e1065197e0c3cc22
SHA512c5d99453726dacd79ddbc1c57d67314aa1d68ac2d25990a576f5a3dfd1a65b2d163722450cbeb6097da6082269ec9828694a4fbc3a74d602344ccc045e2692a4
-
Filesize
372B
MD5d283758972a8909edb6e0103b8fff004
SHA19f31452b21b6efec39cdb6ab8d05491b5b3aa8ce
SHA2566e38f9ab7a3ffa78edf8fb30062df1be5dcf540fb89e438a76386efcd810cf47
SHA51267e757315a53c758280c32217f1b84663b0ac34d1e8266b6805fcc8ca80bf339f8333fa723eccdf16b6759d4bf7403e5a93f2e241ef9864772dfe04ec7aee404
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
96KB
-
Filesize
260KB