Analysis
-
max time kernel
150s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
20-08-2024 23:11
General
-
Target
b13a0a751da316ca82b0646c1e0d8d7a_JaffaCakes118.exe
-
Size
376KB
-
MD5
b13a0a751da316ca82b0646c1e0d8d7a
-
SHA1
20d68222e316828048468568484d5b35fb2f3bed
-
SHA256
90dad1a92ea5dfcbb51480d367e1a8e66564fb8302267be14dfcb1671904e528
-
SHA512
00a96b9a24ed2461a563a5c81e9521909123add27eccc2356d74ce30412f2e87946e9bfae2f6817fda1cb9418fe7e72fcea0b4147a0706bcb25459a21bdc1cf3
-
SSDEEP
6144:lSnPobDUShUmcREtiUcvpKey4Kkb0c/Fnk06hiqP2NXoiyJmEW5c1xZu9MYRVv1:sngbDnsREtirRK3LZSey+2NYxM5Cx8Su
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b13a0a751da316ca82b0646c1e0d8d7a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b13a0a751da316ca82b0646c1e0d8d7a_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\bFh16601aDcPl16601\bFh16601aDcPl16601.exe"C:\ProgramData\bFh16601aDcPl16601\bFh16601aDcPl16601.exe" BOMBARDAMAXIMUM2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\ProgramData\bFh16601aDcPl16601\bFh16601aDcPl16601.exe"C:\ProgramData\bFh16601aDcPl16601\bFh16601aDcPl16601.exe" "C:\Users\Admin\AppData\Local\Temp\b13a0a751da316ca82b0646c1e0d8d7a_JaffaCakes118.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192B
MD50de10be395953c8044b6be3bab6e8a08
SHA12248e9433533c6f0e05efa3152cca88b5ccef04b
SHA2565799655ae32645650161e8fd3429fdc69eb5a2526b71f8b6d580dcce4a654f3f
SHA512107397939b80c7e4223dfcb876ed7750677efbcf113842327e5bd03e7c57c2ceb131981e244d0c4acc84803a5fe046d8442782340708f697a1a127a89da452ff
-
Filesize
376KB
MD5252a5aec18c4f4f236d8210c0760c326
SHA149c6d738a10a19be6062288fcc6d714ace350792
SHA25642f26258aa01cc942552354145cfc2a33b4dddb567025d2ac42a45cba86499f2
SHA5125bc8addc4cb75b12093f088564326bbb5388eb7c7333887ba9615a7a13165a9af3a75af49f87a39901d74f0db56bdd330d3ebcdfa9e8fe08e9e26896bd5f111b
-
Filesize
192B
MD5eeb940a1cebacb95604edff6c6b93f23
SHA16760ffbe95ca1185594349dd3807a1ecd1b3dfa4
SHA256aa6a72bddb520367283ea9f094f24234605e8bc86cd6f02f9dac8f8ca34fd740
SHA5126be902f56afc5d4ddeab48c222062b0ea9827e92378cff1a94d67d8df4ff2bf75b8e65f427007e2e6c2bb406998177988b90c6bafede356eedf1b217622a0e5e
-
Filesize
868KB
-
Filesize
868KB
-
Filesize
868KB
-
Filesize
4KB
-
Filesize
868KB
-
Filesize
868KB
-
Filesize
868KB