Analysis
-
max time kernel
150s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
19/08/2024, 11:15
General
-
Target
aacafb37e82716316348bc915eded882_JaffaCakes118.exe
-
Size
434KB
-
MD5
aacafb37e82716316348bc915eded882
-
SHA1
a379986d7e0659ce9304b9ea6dd352dfc7a55147
-
SHA256
f5f52affdf8b9dc042bc5886ea985af021d6db90199478d38129596f3b76688b
-
SHA512
654b974e9fcabda96893405c7e4bd06974cb9d0d7855c981ffc1fd9a223bd599f68f71e3a7fcf518d1f8238cd52aa09fac2bcb9f29e30bacd1c5b616445c7e80
-
SSDEEP
12288:0KVy1W0rSJEGg5Lmw62LGV2ou19dat26KrZ:0KV+W0rSJzgpmwxG
Malware Config
Signatures
-
Disables Task Manager via registry modification
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\aacafb37e82716316348bc915eded882_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\aacafb37e82716316348bc915eded882_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\ProgramData\uTYNEsbrvPE.exe"C:\ProgramData\uTYNEsbrvPE.exe"2⤵
- Executes dropped EXE
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
434KB
MD5aacafb37e82716316348bc915eded882
SHA1a379986d7e0659ce9304b9ea6dd352dfc7a55147
SHA256f5f52affdf8b9dc042bc5886ea985af021d6db90199478d38129596f3b76688b
SHA512654b974e9fcabda96893405c7e4bd06974cb9d0d7855c981ffc1fd9a223bd599f68f71e3a7fcf518d1f8238cd52aa09fac2bcb9f29e30bacd1c5b616445c7e80
-
Filesize
344KB
-
Filesize
464KB
-
Filesize
4KB
-
Filesize
344KB
-
Filesize
464KB