Analysis
-
max time kernel
140s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
18-08-2024 20:13
General
-
Target
a80e70d7b09195f2297d4743449ccc0a_JaffaCakes118.exe
-
Size
70KB
-
MD5
a80e70d7b09195f2297d4743449ccc0a
-
SHA1
a0d428cb3a2435ac6fb43e051efd74c98bc54812
-
SHA256
ec21c430c7f5e3c1fc7ff2661d0ae48a73ddedd3b9dc942bd7c6dd1dd71fb577
-
SHA512
61ecaa90b64c1c0b419a97810df3e5d2186f383ecbbc2f4f0cbbe5ecd03c28db2e1a208b207c1750bea8b4f5fa240c0bf1bfebcf0249328f7e6528a228cee0f3
-
SSDEEP
1536:JY5fA48bnhYRpdv8iOq1A8ehDmkLuzEa5TUgEmzHSBmI+ldE9xcH:JYNutqdv6q1AtDKXTuBmV3E8H
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Kills process with taskkill 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a80e70d7b09195f2297d4743449ccc0a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a80e70d7b09195f2297d4743449ccc0a_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM explorer.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
132KB
-
Filesize
24KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
20KB
-
Filesize
132KB