Analysis
-
max time kernel
71s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
06/09/2024, 18:19
General
-
Target
d02c6a1c08633d671a9fd67af79881e0_JaffaCakes118.exe
-
Size
46KB
-
MD5
d02c6a1c08633d671a9fd67af79881e0
-
SHA1
b08425894187326a1903e07968f087a854259580
-
SHA256
24b5dc63212cc54f3a0dea08097f2bdd23ea10ff24b9791ca3e2b1ef86edd684
-
SHA512
1b62736651c59e66f3d573c0d27146c1f1ea7fc0e6dbba00dc5f22d401f73e7dac72d9380aeaaee926251af6bbc2a35a5a34027cf4f027b34d3086a0edf9021c
-
SSDEEP
768:bcyf6tF/N72yzJGwRwqGvW4GmGHzUPJWfHhSrQONjWQoeR+9PoOI7e/w6Gh:vCF/NKyzgmfGq8XN5gNIS/w6Gh
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Loads dropped DLL 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 10 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 16 IoCs
-
Suspicious use of FindShellTrayWindow 29 IoCs
-
Suspicious use of SendNotifyMessage 19 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\d02c6a1c08633d671a9fd67af79881e0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d02c6a1c08633d671a9fd67af79881e0_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x59c1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
39KB
MD5ce1574620f471d7cc3e3885ae604af0c
SHA1bb72ffcf6b9d4728e7cb901ee512dc7e75e7cd37
SHA2563ad27b959ef5e1cee681f071c5fc747353ad13d611fefbac5b5eb97c105765f8
SHA5129452306476dfde31087f1dff5dda9a0f74489e2e3a36642e6d5c8c0000ae244c0047cc53cdd18959ab565a4423a3da0ff20fca73563324e6aea0e6c817401cc8
-
Filesize
44KB
-
Filesize
68KB
-
Filesize
36KB
-
Filesize
36KB
-
Filesize
68KB