Analysis
-
max time kernel
135s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
19/08/2024, 11:34
General
-
Target
aad92236a0ece7584df30e8959eff4e2_JaffaCakes118.exe
-
Size
368KB
-
MD5
aad92236a0ece7584df30e8959eff4e2
-
SHA1
7979843cc2333070d90047f02870d404e3e97ee2
-
SHA256
0c6ff9c1320e36c77ae6e33b405115451773c10c8264a0049b4dcd1416840737
-
SHA512
b0a69a6a387fa001d6a8d74ef1be67537f0ac2493ca650f0c605c08c17ab639cd0751bd9f6cc4c252b348a3afbae68d3a0940a78559d0bd0d8d7d1d1ea6b799a
-
SSDEEP
6144:K3hF2BrAWhKSfMAg8VE5LvaGkWFqAQ9CUcx7EXmX7EYoPkvEznwnMRFjzrp:Kz2B9k4V+L3Furao2RgkvbnMXN
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 8 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\aad92236a0ece7584df30e8959eff4e2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\aad92236a0ece7584df30e8959eff4e2_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\eH01602IpIfG01602\eH01602IpIfG01602.exe"C:\ProgramData\eH01602IpIfG01602\eH01602IpIfG01602.exe" "C:\Users\Admin\AppData\Local\Temp\aad92236a0ece7584df30e8959eff4e2_JaffaCakes118.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
368KB
MD5d6123715153e6ba3acb7b8d1d1b76bbd
SHA169f7662fa3a934d736dd0218eb0bd500b1c912af
SHA256dfa30b33203eabed9c86042071f819ab05717886c677b1eb50161afa83f6cb74
SHA512af4a112f3f396fc9fdaed326e75a00deb6adca072e2103d1113b0172092be1cdf318cca0db41b3adb76b40b6c2c7395d09577cf3f8b71fda4827ddf743f45bf1
-
Filesize
12KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
4KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB