Analysis
-
max time kernel
60s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
21/08/2024, 15:16
General
-
Target
b3f993fd6ea1275c7570fe97059c9c35_JaffaCakes118.exe
-
Size
186KB
-
MD5
b3f993fd6ea1275c7570fe97059c9c35
-
SHA1
1cb5d188b6e30865121b4dff1d09037775fdf178
-
SHA256
5c9047f3d3b45278d095dbd5dc83088ac1a810d7ecea4836886df3f4071fd9d7
-
SHA512
95a37a8cab7a35865618044c9f5fa731a5507f08e5f328aeb6626519fe7c2d4f43ac4a9aaba76e6a4da72a77f098b22f501bba62379486009b3544345381b795
-
SSDEEP
3072:4HPPOirDqttSmVYaKsZOAqW4WzbIcf4IT3nHLAsigaJJEY1gywb/1bf:4vPbqimV755LdzMcRnHwJyYyywb1
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in Windows directory 4 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b3f993fd6ea1275c7570fe97059c9c35_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b3f993fd6ea1275c7570fe97059c9c35_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Ivovoa.exeC:\Windows\Ivovoa.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
186KB
MD5b3f993fd6ea1275c7570fe97059c9c35
SHA11cb5d188b6e30865121b4dff1d09037775fdf178
SHA2565c9047f3d3b45278d095dbd5dc83088ac1a810d7ecea4836886df3f4071fd9d7
SHA51295a37a8cab7a35865618044c9f5fa731a5507f08e5f328aeb6626519fe7c2d4f43ac4a9aaba76e6a4da72a77f098b22f501bba62379486009b3544345381b795
-
Filesize
372B
MD5ae2dd00ede014429c2b118b5d7cfc893
SHA1b9064b461f14c701df854fefa3b9c961c55e4e89
SHA256e475acb197c33b6feb42a420ed2f5e746e6fba92abf80c9a677323f4d1fba35e
SHA512bb8fd011a96e2c757cbacdbf119eb8d2a84a09699aa9b625af4039c6cab8f93ffafa8ed84269330813d5839baa304db402f6d42ffdbea1264be5be04c042adc3
-
Filesize
396KB
-
Filesize
4KB
-
Filesize
232KB
-
Filesize
396KB
-
Filesize
396KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB