Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
20/08/2024, 21:55
General
-
Target
b0fc90a88819b999d202dc22cf5f35c9_JaffaCakes118.exe
-
Size
212KB
-
MD5
b0fc90a88819b999d202dc22cf5f35c9
-
SHA1
1d4d72975666a994012689e87e201e1cc75620d0
-
SHA256
f3765223815e67c9a1aa45aa4b8f3a18dd8ee23a60d9e3e01eb4f2b5e86e1abd
-
SHA512
e2a7fdc4ed5b3d4b3a93d1e883bc47668b1ae0e4acfabb349b752892c00a60140f9bc28c4da49be53644df4cc23c6f334e13b090db9e0c745ad62b3ca9b5cead
-
SSDEEP
6144:KAEkK6rmEnOwO6esxm1XwY7XEjZufoKEy:dT3rnOwO8xm1XPX8qwy
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 6 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b0fc90a88819b999d202dc22cf5f35c9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b0fc90a88819b999d202dc22cf5f35c9_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Hnifua.exeC:\Windows\Hnifua.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 8363⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2888 -ip 28881⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
212KB
MD5b0fc90a88819b999d202dc22cf5f35c9
SHA11d4d72975666a994012689e87e201e1cc75620d0
SHA256f3765223815e67c9a1aa45aa4b8f3a18dd8ee23a60d9e3e01eb4f2b5e86e1abd
SHA512e2a7fdc4ed5b3d4b3a93d1e883bc47668b1ae0e4acfabb349b752892c00a60140f9bc28c4da49be53644df4cc23c6f334e13b090db9e0c745ad62b3ca9b5cead
-
Filesize
390B
MD51e58ed27da801019f507f24c3ec9d033
SHA19d0f2faa416057de6bc9f0978c33ec0dda7bb1b1
SHA256efe145d2c12db687bca576ae473e613d81a68267672fe4a81434a242cbaf0721
SHA512c7a30303a50c2923fc2f5a56a37c897b0db55de57de629020c035cf85946434dbebf9a51fbb2b6935fcc2aaba7b79022fcce523fddee5a4da857fcd941e8cfe0
-
Filesize
232KB
-
Filesize
4KB
-
Filesize
508KB
-
Filesize
4KB
-
Filesize
508KB
-
Filesize
232KB
-
Filesize
4KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
232KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
232KB
-
Filesize
508KB