Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
21/08/2024, 14:26
General
-
Target
b3d328bded51430a1635f31a202ea5d9_JaffaCakes118.exe
-
Size
212KB
-
MD5
b3d328bded51430a1635f31a202ea5d9
-
SHA1
001eb9084c9073ef4c36b2531b7b6e58e9f8a598
-
SHA256
912419985217067f1a392e7e58bee4db0b2215fc3144dbc23c13fad1b5c4614a
-
SHA512
bd8f07ac6c13fc0f410f0835dfb4c27663542940f9b822afa80426125f0ef73f43171c6cffab5f8329ca81e90d5081ee1d92d5a087fd4cbca86cf442f8be3f6d
-
SSDEEP
6144:EAEkK6rmEnOwO6esxm1XwY7XEjZufoKEy:7T3rnOwO8xm1XPX8qwy
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in Windows directory 4 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b3d328bded51430a1635f31a202ea5d9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b3d328bded51430a1635f31a202ea5d9_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Ucuqaa.exeC:\Windows\Ucuqaa.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
372B
MD5314913934a4a2753f4f672be84e4bbb6
SHA12268a15e897656224c417c3ba93cb095a3e2b774
SHA2562c560dcfaa351317fe3aeb158b7508cac570f055e3eec0d4844eff91f354a6d4
SHA512746920168da000d4cdbbb0b6fd6478a27a3b8f24cf0a3c13f5710ae6e673567e4e7154792422a2a0633f4e5bf18f1b59620a5239fe620b9791907f81f1dd5b66
-
Filesize
212KB
MD5b3d328bded51430a1635f31a202ea5d9
SHA1001eb9084c9073ef4c36b2531b7b6e58e9f8a598
SHA256912419985217067f1a392e7e58bee4db0b2215fc3144dbc23c13fad1b5c4614a
SHA512bd8f07ac6c13fc0f410f0835dfb4c27663542940f9b822afa80426125f0ef73f43171c6cffab5f8329ca81e90d5081ee1d92d5a087fd4cbca86cf442f8be3f6d
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
232KB
-
Filesize
1024KB
-
Filesize
508KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
4KB
-
Filesize
232KB
-
Filesize
4KB
-
Filesize
508KB
-
Filesize
4KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB