Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
26/08/2024, 01:27
General
-
Target
c20245dc60e3b802675db4c58eb8a969_JaffaCakes118.exe
-
Size
2.1MB
-
MD5
c20245dc60e3b802675db4c58eb8a969
-
SHA1
c0048e2c7c60aff0365318ccac1e7a92b6bfc206
-
SHA256
8572fd4106f2f586043a93d7627c1f47adae710923e6e55aa1ff91976276018a
-
SHA512
37a7b350218a5f955c8ad3e9dd638f61cb9ed3c04fb39452572bd28f6b037ee731e26abaaacfa3f50996b1d250f1ef6470a3329242f995cf2b1782649d55b223
-
SSDEEP
49152:KaQRibZEQmRZKL8iecS//Ll9Ae5WEb7JZ:K5RibSpfcUB9cEb7T
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 16 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in System32 directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer start page 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c20245dc60e3b802675db4c58eb8a969_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c20245dc60e3b802675db4c58eb8a969_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer start page
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dnfsy.dllC:\Users\Admin\AppData\Local\Temp\dnfsy.dll2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\dfdat.exeC:\Users\Admin\AppData\Local\Temp/dfdat.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
35KB
MD5b97422f93b63f07746314b9d405d93a0
SHA12cf6b8145d407466e49eadfa7b362a40aa0c8f80
SHA2564c982cd6a4ed1faddf50965f2e7028a2799626ef1e692919f4f59600a577cb72
SHA5129534763d64fbc401b008b96f8bd32d0bd33cd96e60c8343042eb023d420ec2e7e206970ba14a4714a7fa6f3058ed83d6ebadb98e0da371968396bdd2409d9983
-
Filesize
1.5MB
MD5f8a53e5506e8460882c10e0346ca3707
SHA1bcb47e0b2e97190c02c5894c187fa2e17dd517d8
SHA256de80d3c1ddd7ad72c4d4579623265d7970e85a3c62c2ba4fe09a6f885d02556b
SHA5121624024b4573c3a18c00eab7ef9b2f5fd941217dfd855d7a9869a1b2e9a8af2183a5241f145629971c94974b0b0de6200c7d03abdffc4cefc1efa7e338b55691
-
Filesize
688KB
MD5bd42ef63fc0f79fdaaeca95d62a96bbb
SHA197ca8ccb0e6f7ffeb05dc441b2427feb0b634033
SHA256573cf4e4dfa8fe51fc8b80b79cd626cb861260d26b6e4f627841e11b4dce2f48
SHA512431b5487003add16865538de428bf518046ee97ab6423d88f92cda4ff263f971c0cf3827049465b9288a219cc32698fd687939c7c648870dd7d8d6776735c93c
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
8KB