Analysis
-
max time kernel
150s -
max time network
35s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
29/08/2024, 17:55
General
-
Target
c952eddffd5ef0c20de323a9256f4e5f_JaffaCakes118.exe
-
Size
396KB
-
MD5
c952eddffd5ef0c20de323a9256f4e5f
-
SHA1
b025cf365a3d00712b16a3f9a055f8806e6bc88a
-
SHA256
50bfa313e08d07d4b3f5e471a220f135cf3b2e06d017bd8cfd73d7e050728515
-
SHA512
44b6932ca665ae174898298134cac218acab53a0f25b265a80e2cb26e1b8e10ad4ef34751f6a27d8839a2b7d86edcdc98786ad73eba80336726ff8b25cfa9f12
-
SSDEEP
6144:qqgDfKLdpUBGd6kxqOMuJettO4lQsOiuPbxKrljMhhddcemMwzmoh:qqgDfKLrNNEOMXHoDhPbxKRwcefBo
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c952eddffd5ef0c20de323a9256f4e5f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c952eddffd5ef0c20de323a9256f4e5f_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\aO10400GpIhC10400\aO10400GpIhC10400.exe"C:\ProgramData\aO10400GpIhC10400\aO10400GpIhC10400.exe" "C:\Users\Admin\AppData\Local\Temp\c952eddffd5ef0c20de323a9256f4e5f_JaffaCakes118.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192B
MD5f99177c0dc3b4d53a4f17a2412ffc548
SHA10b1c1e096334336f0d1ff9b9400bdc5a4573dbec
SHA2560938be3b22f62b1d1e8e73966e928828da4e287ec1ce30a7b5b90ff6eef2bb9a
SHA5126db135a1825019316b9fd16a91e2ebfcb6768a93640a38b2cd447e5e033718a5401f7d75c4dac4b577e66fb818930a151724f2fb08d424121df0a2eee8c2ea5b
-
Filesize
396KB
MD50318e2c180935fc687f2faad5937602f
SHA1431cb6ee7cce1c3483e715e0c44e2589a6e8b35a
SHA256c310872f680dfb7909dac4891a719552a0990b83908950c1feffac602bf53feb
SHA5122d540972cde557d80be68945671f8614029263b393e3e50a7be22ffe09c7391a8b1c76f7632ff1499039b6d588abce7b0b5fa43e415f54e37458cf072dd73e71
-
Filesize
12KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB