Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
06/09/2024, 14:54
General
-
Target
cfcbec9eab86e6f98e686f7a118c3b30_JaffaCakes118.exe
-
Size
23KB
-
MD5
cfcbec9eab86e6f98e686f7a118c3b30
-
SHA1
100f51b4b77a344dfe124e0a62454ba22d4fa8c4
-
SHA256
bb63759638c4335600f052ecba7cb276e3a279b12621799fff4ed81e44344b79
-
SHA512
598aa1287b5b93366f7ff07e7f7adaf1a9207fc31990b1b973dda29cc73d4de02a5b6c2e1827bbd3aade7ef380705e2fac4909efef725653fcd39dd6d98613a2
-
SSDEEP
384:ZqR/3dWKy2eQLxVnezTjpR645Ukjyqt/WrEyfZz+LE/TW6D7vgNq358doXNtqg93:aWK77LxV8TNR6GUkOqvyt9bW0vg43Bdd
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
-
Loads dropped DLL 2 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cfcbec9eab86e6f98e686f7a118c3b30_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\cfcbec9eab86e6f98e686f7a118c3b30_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
15KB
MD5d5e6de32f988e7ff3baa1b8e8e36403f
SHA1387bc63a7aae94654cd931399382f071db5f0d58
SHA256c5b117cec777c9319aa234caa968a9467d4981ed648b31f43a3117cb4fce21a6
SHA51289abef857508638f34de3e59f747bea36f1bc469970ab2dfcdf4c4c68705080a4ea0edf78e935188581fe6cffa6ec56ce80b4fff290ded3df9255679e1d25c4d
-
Filesize
48KB
-
Filesize
4KB
-
Filesize
60KB
-
Filesize
48KB
-
Filesize
4KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB