Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
19/08/2024, 00:52
General
-
Target
a8eb04be6c829737c622632a1839396f_JaffaCakes118.exe
-
Size
443KB
-
MD5
a8eb04be6c829737c622632a1839396f
-
SHA1
f239934b1a920fa39a4d8b8dadc30801ad275c64
-
SHA256
a34f7e418147fcc13c5a9a9fe6e222b365c3c483f54626a31cb576f574a26fb6
-
SHA512
212ddff16bd718fa22c33e9c68ce7d4bdb5e69db348416d17c560b9c03eb3f77688afa73c7f1b69f1386953b5e24c8d92deb6faa7f59108cf634470b3afda5b4
-
SSDEEP
6144:ueW0FbGzEPsdksJ2hyY4jfQXwwhZ7HxCGpJv5U0jfpi13EJ6iymz/wGvktiuY/Y:tFWkhsghyLfQgwsuLjf43EKmc0kf
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a8eb04be6c829737c622632a1839396f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a8eb04be6c829737c622632a1839396f_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\pE01831BpJkC01831\pE01831BpJkC01831.exe"C:\ProgramData\pE01831BpJkC01831\pE01831BpJkC01831.exe" "C:\Users\Admin\AppData\Local\Temp\a8eb04be6c829737c622632a1839396f_JaffaCakes118.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192B
MD54178595edf0f8f50097cf3c1ab99285e
SHA187f53f6932559f3a239e7e7e18ee4b2e16a71c20
SHA25615029d41884ace8ac8b3690141d5dbea60b07ea7f2be38bcdb683fd58026a1af
SHA512f1cd4f0a607baaaa726c7acf5761b21a9db69c104b571f6c7d5dd7465a484013839b96f73ec17b600b6e4c20fc89e77406508516dab71c8715bbd092161aecfa
-
Filesize
443KB
MD5a18ff40f5fa9526471be656c026bbf3a
SHA17ffa3c283a9d19ec9a1977aebe87abf26ba21bc8
SHA256ea546dfef4e50da22ba4b6222df940429e73b6c99d0688b99d3e8132259d9a47
SHA5124b3c695784eaa1594c13411a014d4753914c98c95102d32cca9f8c7d72fae6db759e6c43112b4310be083a0b61bd9bc26244d2b693ad6bf638bc4f9c97da8665
-
Filesize
764KB
-
Filesize
776KB
-
Filesize
764KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB