Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
21-08-2024 23:10
General
-
Target
b56b3d60b6690a7c362238064157066d_JaffaCakes118.exe
-
Size
328KB
-
MD5
b56b3d60b6690a7c362238064157066d
-
SHA1
7986f2be63cbece65cb05161b46fd768c7d6458b
-
SHA256
78eede87103d33b381894a07e3c1f2812b427d06566ca55612c4054aa5c63d20
-
SHA512
bd5e5a8c65ea494782a9978414df25d3a3c8f5afecb3ece3d2c1eb544dd49a61f3af9c028f23d9a3d809f73aef12cdfb33cf6020b3b3d8dc194a847b0d101e73
-
SSDEEP
6144:CxVpBMDHXxy+CdFr/GJS0hGaMUXjyIU4Ozwp05M8:c7OD3wDjTGJZcatjQXzksM8
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b56b3d60b6690a7c362238064157066d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b56b3d60b6690a7c362238064157066d_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\gM06523NkNcG06523\gM06523NkNcG06523.exe"C:\ProgramData\gM06523NkNcG06523\gM06523NkNcG06523.exe" "C:\Users\Admin\AppData\Local\Temp\b56b3d60b6690a7c362238064157066d_JaffaCakes118.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192B
MD56b6361f12f67c19114ba4aa7387c7c59
SHA175b99cfee560ff2d36e8ec824b5b91f9dfcefd89
SHA2562f2a00925ed625cbf4f8eecafa0ab8a50957a79eeb33fe4581a06ce274d44706
SHA512c2a605c0a2a9d8de0a98674cf11077916d229c6af7d0d413321c57d967f2e70b411782551dc8c4e799fbb6233c59da4c2e61461ad551744990704821e682a7fb
-
Filesize
328KB
MD5cc2c665118337a76fc71cefe595397e2
SHA1ba3b1a0cafc8bdb6fcbb302423feb3b1c76c5810
SHA256a49fb460d5a6b66e259945236f36afc9201f76f4210ae4b56d9a13c9e3a6e7d6
SHA512abf685120a53ab96fe6fdbd6a54b0556a42c841a4f54a1092ba76e512df4677b7d9d066e296d3b74c021ff80251abe8fd8b3eae3ac403cdee32152b99214eb48
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
12KB
-
Filesize
768KB
-
Filesize
12KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB