Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
19/08/2024, 15:56
General
-
Target
aba2e50fb22a83f644352baa8736abbf_JaffaCakes118.exe
-
Size
636KB
-
MD5
aba2e50fb22a83f644352baa8736abbf
-
SHA1
58d08157179664c06efa98766289d7f62ece9019
-
SHA256
afbee48316b6e8e9da48d9bfafd569a131c630bdab8fc4d29f0ad3c1b1da3828
-
SHA512
d0dd55b08c965a5c8451d26de5da2830601e5048b0b5318d33c3fe9a0d934c244a4e99a57c6ab478e28cff8907406b4b719840e79bb638ad2ce9f4d2e6f6ee1f
-
SSDEEP
12288:sb6FlOWf+udFfWXma7F4+/lATF3Z4mxxcFtg+vC4GWCiO:m2Bq7m+/lATQmXcm+KpFiO
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Drops file in Program Files directory 2 IoCs
-
Drops file in Windows directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\aba2e50fb22a83f644352baa8736abbf_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\aba2e50fb22a83f644352baa8736abbf_JaffaCakes118.exe"1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\uninstal.bat2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\vass.exe"C:\Program Files (x86)\vass.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
636KB
MD5aba2e50fb22a83f644352baa8736abbf
SHA158d08157179664c06efa98766289d7f62ece9019
SHA256afbee48316b6e8e9da48d9bfafd569a131c630bdab8fc4d29f0ad3c1b1da3828
SHA512d0dd55b08c965a5c8451d26de5da2830601e5048b0b5318d33c3fe9a0d934c244a4e99a57c6ab478e28cff8907406b4b719840e79bb638ad2ce9f4d2e6f6ee1f
-
Filesize
218B
MD5addcf83c88886a3663243c83ef0b07bc
SHA1e6630398c186dfe4f0000b455351836b488ad359
SHA2566e282b29f8ae52f4a82eaf624a8954a077c53d3f2ae0ac6a5c32f0ca967a73db
SHA51243efef34087cd2d033a8147d752bda3845fad1be625014435b5e2e3bb43bc5c76d4bc771547fae3c2ad383b6fea63f45fe23050d09ba17e2d129931827e2133c
-
Filesize
1.1MB
-
Filesize
336KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
12KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
336KB
-
Filesize
1.1MB
-
Filesize
1.1MB