Analysis
-
max time kernel
141s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
28/08/2024, 18:13
General
-
Target
c76286034161bfb771a311f5238e032b_JaffaCakes118.exe
-
Size
710KB
-
MD5
c76286034161bfb771a311f5238e032b
-
SHA1
f24a3e262484d837df6633a3b187a2d51c76ee5b
-
SHA256
e569629ea4cdac44d18ebf193b021a4c1d187a97176015c317ee75364ac8533f
-
SHA512
31f1a48c86e598c06e715cc13939a23291f4a5090bcb68243fe8441b2e4b904113919c91441e2769d723c4d8e01e23f37d767a9894fd23f6f216044372bef903
-
SSDEEP
12288:39xEIhI1gi4kRFpKaqkbmgiZmdcccvpohF3Z4mxx4lv1+mRrzMD/QvV:LEIhugi4uFpKQmgigNcsQmXOhKm
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Drops file in Program Files directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies data under HKEY_USERS 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c76286034161bfb771a311f5238e032b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c76286034161bfb771a311f5238e032b_JaffaCakes118.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\HgzServer\www.hmhk.cn.exe"C:\Program Files (x86)\HgzServer\www.hmhk.cn.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
710KB
MD5c76286034161bfb771a311f5238e032b
SHA1f24a3e262484d837df6633a3b187a2d51c76ee5b
SHA256e569629ea4cdac44d18ebf193b021a4c1d187a97176015c317ee75364ac8533f
SHA51231f1a48c86e598c06e715cc13939a23291f4a5090bcb68243fe8441b2e4b904113919c91441e2769d723c4d8e01e23f37d767a9894fd23f6f216044372bef903
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
336KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
4KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1.1MB
-
Filesize
336KB