Analysis
-
max time kernel
132s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
21/08/2024, 14:26
General
-
Target
b3d328bded51430a1635f31a202ea5d9_JaffaCakes118.exe
-
Size
212KB
-
MD5
b3d328bded51430a1635f31a202ea5d9
-
SHA1
001eb9084c9073ef4c36b2531b7b6e58e9f8a598
-
SHA256
912419985217067f1a392e7e58bee4db0b2215fc3144dbc23c13fad1b5c4614a
-
SHA512
bd8f07ac6c13fc0f410f0835dfb4c27663542940f9b822afa80426125f0ef73f43171c6cffab5f8329ca81e90d5081ee1d92d5a087fd4cbca86cf442f8be3f6d
-
SSDEEP
6144:EAEkK6rmEnOwO6esxm1XwY7XEjZufoKEy:7T3rnOwO8xm1XPX8qwy
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 6 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 61 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b3d328bded51430a1635f31a202ea5d9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b3d328bded51430a1635f31a202ea5d9_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Xpatua.exeC:\Windows\Xpatua.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 8163⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2028 -ip 20281⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
390B
MD5fba65bb424e59b8d02e66f537b14b684
SHA17cc0269eb8076b7dd1203bb2066424dc1c9ea9a1
SHA25696721fd1a8e32a1fdb423f99117fad94f0b2b05dd03dae41dd7332c377b3ff59
SHA5120f2223745ff20cda440d7eb33bc5af6743155193cafd65c605a286ebd3a7bd339d21e0b8161489e63aa469a9113a625e8e21c6ff31892b29ee149e66028ca30a
-
Filesize
212KB
MD5b3d328bded51430a1635f31a202ea5d9
SHA1001eb9084c9073ef4c36b2531b7b6e58e9f8a598
SHA256912419985217067f1a392e7e58bee4db0b2215fc3144dbc23c13fad1b5c4614a
SHA512bd8f07ac6c13fc0f410f0835dfb4c27663542940f9b822afa80426125f0ef73f43171c6cffab5f8329ca81e90d5081ee1d92d5a087fd4cbca86cf442f8be3f6d
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
232KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
508KB
-
Filesize
4KB
-
Filesize
508KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB