Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
31/08/2024, 09:18
General
-
Target
cc8b5a30376e83f870559336525cb8bc_JaffaCakes118.exe
-
Size
2.8MB
-
MD5
cc8b5a30376e83f870559336525cb8bc
-
SHA1
0bc8ef628007f6c5c2dcfdb69d11fc1e30a127a7
-
SHA256
b6ab04611ef5f5262ca25b70fc534b881f96edc1f3fd8970e78dfa19e1fc85ab
-
SHA512
c7f07468ef3555e3ff92459f9f88f19ea137a0ca7a245c1b39db7991e5d8b716e81fdb554ca3d7df66d0e0eec148d6ddf9048e233fa973e5df943c71fa7c5529
-
SSDEEP
49152:LtfsQ9EC3S+pGz/Jb3H33Z9A63GrzGeLMRStvTM1:1sQVpGz/533386Wr6eLHtw1
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
-
Executes dropped EXE 2 IoCs
-
UPX packed file 11 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Drops file in System32 directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 5 IoCs
-
Suspicious use of SendNotifyMessage 5 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cc8b5a30376e83f870559336525cb8bc_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\cc8b5a30376e83f870559336525cb8bc_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\AV Protection 2011v121.exeC:\Windows\system32\AV Protection 2011v121.exe 5985C:\Users\Admin\AppData\Local\Temp\cc8b5a30376e83f870559336525cb8bc_JaffaCakes118.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\a6dWK7fRLhXjC\AV Protection 2011v121.exeC:\Users\Admin\AppData\Roaming\a6dWK7fRLhXjC\AV Protection 2011v121.exe 5985C:\Windows\SysWOW64\AV Protection 2011v121.exe3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
612B
MD51de8b4f6214baff698766458b8597d57
SHA14c0b7a17295d03c24092651e3cd697b0c9a8a7d2
SHA256df47f77a6901331ef4f469b9c99eecb40c3bcda0a91ffc85e3e57b4d6dedb27f
SHA512dc2a86cc4115855a158c92ba8a18e60ddcdba440dcb78cea962f11414c19e156df0907e780d66fb85b723bc4a698bd047ef5e5207e9d2a41a98d7fc78f5f3c39
-
Filesize
1KB
MD5b4d1ff54f173894ca7dc94f834114b7b
SHA162ae6ed27b215b63fc3a5e7c8c41d7524d17eb4e
SHA256981373764467b4a11f3e745b339ea95604374425f87efab464023d56ada13ec3
SHA512a488170b6b01ea14062503afac834c114454c7234820f6b8f694eaaeec27015f742138fbfde07431cbbe5e9edfd2697d94898d2f691ff6401cc6585511b207fc
-
Filesize
2.8MB
MD5cc8b5a30376e83f870559336525cb8bc
SHA10bc8ef628007f6c5c2dcfdb69d11fc1e30a127a7
SHA256b6ab04611ef5f5262ca25b70fc534b881f96edc1f3fd8970e78dfa19e1fc85ab
SHA512c7f07468ef3555e3ff92459f9f88f19ea137a0ca7a245c1b39db7991e5d8b716e81fdb554ca3d7df66d0e0eec148d6ddf9048e233fa973e5df943c71fa7c5529
-
Filesize
1KB
MD57eab0ddcbf3cec31ec7731b53fdb09d0
SHA1bd75e8a2e47b1153d901874b4ecaff0c1222d149
SHA256a0c9a8935e73279c9a1891afdfa494667cad34cf55063ad912c00ef3706cb280
SHA512aff2f2bfd15f2840e0939b8fd73fea30797394d9fe5d14d02c86df6fe2ee5d28dccdfc3838777b8678c7c8278d3ee286dca219d4344b8782bca52a6dd1e9f4ca
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4KB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB