Analysis
-
max time kernel
131s -
max time network
21s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
26-08-2024 06:44
General
-
Target
c279c40d12aa8556a37c1691579a6b6f_JaffaCakes118.exe
-
Size
6.6MB
-
MD5
c279c40d12aa8556a37c1691579a6b6f
-
SHA1
15b58b3327a5bf9df61383e1be563994e8e82b05
-
SHA256
9f3a7991a9e686a782a472ac4cfca2c26dbb771c2a536bc7984d96aaa10794e6
-
SHA512
2a430fc369698d15166d63dc5b8d675f9d42471e5b2a287f7a6c2900c3e3c9f7b57389554c5403c158300b63daae359ba1f48d26de1860912ab2c71e1a78141e
-
SSDEEP
196608:JZIxhNXjdYone6je57p1FcwUHDy0Mwpq8IK5u7LxSz8:JZA3jq6Q7TFcwUHDy98IKAi8
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 8 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 13 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c279c40d12aa8556a37c1691579a6b6f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c279c40d12aa8556a37c1691579a6b6f_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-L4HH6.tmp\c279c40d12aa8556a37c1691579a6b6f_JaffaCakes118.tmp"C:\Users\Admin\AppData\Local\Temp\is-L4HH6.tmp\c279c40d12aa8556a37c1691579a6b6f_JaffaCakes118.tmp" /SL5="$40214,6419124,168448,C:\Users\Admin\AppData\Local\Temp\c279c40d12aa8556a37c1691579a6b6f_JaffaCakes118.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x48c1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
107KB
MD5c0b11a7e60f69241ddcb278722ab962f
SHA1ff855961eb5ed8779498915bab3d642044fc9bb1
SHA256a8d979460e970e84eacce36b8a68ae5f6b9cc0fe16e05a6209b4ead52b81b021
SHA512cb040aca6592310bffb72c898b8eb3ca8a46ff2df50212634c637593c58683c8ab62e0188da7aea362e1b063ae5db55cf4bf474295922af0ab94a526465cc472
-
Filesize
446KB
MD5dce6d68da86f44ba0cb70fa7718e2e84
SHA158cd39196abfc70b5b9bcc964f41a21024a61480
SHA256b9bdc4a0309aa47613a7b5a680c55839aa7ba28e28f96e6b9316d4d5fe1dbe9d
SHA512bd2f559640b63a46e15a2af90719c10e53e1c30020685163ed6b3bb669197d20d5dd76c7fd1052cf0841e3e1fdbd5a365a4bdb519d2f8fcad9122e77d923e8d6
-
Filesize
1.9MB
MD564101d65027abe80025028af0cfdb6b3
SHA1ad1fa0b6f9abd2df8193ace3c058c6aab6565a2f
SHA256c2debfb2a38bc839365f000878fa4561ddebf4955616feeb812d5adf3094b721
SHA51258caf74ec58dd9a0e7ab3ff11ba89622376ff165cef225c00597ba0522adc42910f53c7b5e2f29fa72ab236b3c4347483fe960acb4f7f9c796162fd6a80b0ab8
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
129KB
MD570cd1d226553f3c0546664d76373fe67
SHA1509d03b6fce1e35b6e848ae88af52b7b9ff42d48
SHA25665a7e7fb213007ba2e285bb2c3e2df1a553990a2a3e26a0a6591f01ce6c87bc0
SHA5125b2487bfffb26ff76988f175e4aa97f7ae83b9dd747bd61ae7d3b338f04447a345186a715bfe0bb86c07cd5c3c829540fc4099254cfee20d873700573ef5826f
-
Filesize
27KB
MD539a339e9c9ecc529202508c9c89a9956
SHA192e697882abb90cba6a783aef98d3d05deb8e4b9
SHA25688160915cd065e25bc0b9b89099663ccbcca606a5707a28a5df12e9c118d4f16
SHA512b96e3bac6da4e3812f09d21d575642beac47338c026f3bc116d42b09cfb492b1e51cc74cbb9d1724e744ec2129619b196247ca1ddc03d8c0a27a2613890cbef3
-
Filesize
1.5MB
MD55e4772b71ba057c189708d2a7d377cc3
SHA180659fbcad0a71b41342b306558eff4d38cfdd47
SHA25631c25e9a2680456f969ee231fb383b6e379faeda32a308009013332076383e7a
SHA512866597cd13182232acd9e7f8e760ff72e3472d6a3f3895659b31e176a9d47032dac97db0e7f569777bd65b8f5b0580871d2f84062325d30f483a1c6bf6fc3556
-
Filesize
88KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
472KB
-
Filesize
1.2MB
-
Filesize
320KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
164KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
2.1MB
-
Filesize
64KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
2.1MB
-
Filesize
472KB
-
Filesize
1.5MB