Analysis
-
max time kernel
90s -
max time network
90s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
23/08/2024, 06:54
General
-
Target
babd3a9a201c3a6cd5ada550921238e9_JaffaCakes118.exe
-
Size
368KB
-
MD5
babd3a9a201c3a6cd5ada550921238e9
-
SHA1
95e205d1626b5f3e5a63de3f63e7ae27d15e0f0c
-
SHA256
28c9ffafc9a32138681ebe3e7020b219f0f85f64fd20a72ebc9781cd8001e1bc
-
SHA512
e0ad0fc61deaa170de56b5669ecba26a74c2d29950b2a71d0703d114b13c3fb5a92e81a1b5d555bd3b73d4add369684d704c6906b04f23f5d8dac821efb060a0
-
SSDEEP
6144:TREWm4Uy0MFJjCu0m/IzJfaBJGlfr6OpyE12ckKY3VYfFyN5xFL9d4VOTm+YWvR/:To41zCV9IJAm1FDlqcNvF92VOMWl
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 8 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 5 IoCs
-
Suspicious use of SendNotifyMessage 5 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\babd3a9a201c3a6cd5ada550921238e9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\babd3a9a201c3a6cd5ada550921238e9_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\nF11022LgLhG11022\nF11022LgLhG11022.exe"C:\ProgramData\nF11022LgLhG11022\nF11022LgLhG11022.exe" "C:\Users\Admin\AppData\Local\Temp\babd3a9a201c3a6cd5ada550921238e9_JaffaCakes118.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
208B
MD58582594d265bc5ae2475f7dbe5ba6eb1
SHA167eb99451c13a2488f92161a0f181d5aa2b8b714
SHA2564e20bcc2400b5ebeb10997ef8c61ef1a2e71e5c7e8414b84379577cb8e4db55c
SHA5121391f0e1ed40fa2259eccbd89d0b4c90ed099fa6c1b417cac513c717883e7cdaa98aad023415d48552328badcac7315385e4209c5e4dd853eb5dda43e287adec
-
Filesize
368KB
MD531d70a3dab9ae3175a6cf9ba789448ea
SHA1d690b1ceb82e594fae22d33e7c625ebc1a0b29b6
SHA256d91ed83922f0e3f06b6322f36b4dab5716e6ab8cbe1b776670bf2e83beca28b9
SHA5123c2b288865a51e09962247bee79101d811208891c06e96a464faabe580640282a09a94efb7b54b3a69e5b6d8b76ec340a8374c6873796cb956943de2ac86ff82
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
12KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
4KB