Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
07-09-2024 03:29
General
-
Target
d0fb5d03b7a8b3f4a567c6c2bfc23821_JaffaCakes118.exe
-
Size
365KB
-
MD5
d0fb5d03b7a8b3f4a567c6c2bfc23821
-
SHA1
c41debb0112bf203f813af4f0ba6efdf62b8c6d2
-
SHA256
2788b1f9ad4c0a12d1e7f5604803ed9939e4d21442a6ef652adf4f6ed8568002
-
SHA512
f2796d06f67ad006ee0002f6e12205d2577b4f5a4c72ab68ac72799888206590f93dbe52ecd021a75f55b97a5c188df3b974be620dc78f8ac012e8c063ce9065
-
SSDEEP
6144:aF9vx0NXgEJL8kTvI/qFUmZQab7T5kaRJMggJEEVlRbkSD+WyWIaNmp:aF9vC+EJVTU5OQdaRag4ESluSDj3q
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d0fb5d03b7a8b3f4a567c6c2bfc23821_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d0fb5d03b7a8b3f4a567c6c2bfc23821_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\bH21922OlAnL21922\bH21922OlAnL21922.exe"C:\ProgramData\bH21922OlAnL21922\bH21922OlAnL21922.exe" "C:\Users\Admin\AppData\Local\Temp\d0fb5d03b7a8b3f4a567c6c2bfc23821_JaffaCakes118.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
208B
MD5653f23afcf61453fb0e45e5e2cff270d
SHA101d28af00cfa942e2184a3a096e004ddbb8bfc3e
SHA25694dfc4726aaf82be7701cb4b4fb875d6bbcc93db74d0b59b8e2678f7bbb97e86
SHA512c238b9b473b7cabea1d1e94d42b4d3a3dabbf8d9b0dbdc5f35db5e536f08b624c00d7bd0dd078fd16cf136a5c6e0d2d289cde3bcf962df2103234021445df88c
-
Filesize
365KB
MD5072fbd1088f84fb7ecad7679f0d37e8d
SHA196625c5f1309836fff35675b8c60f727d6411ddd
SHA25657917667367c28d6c7f92042e72dd574eedb6cbd22ca36387fc8d5377a878649
SHA5125151bee28f234105180cc95ce6bd12bde4dedb56fc1377539575e48b840f8b3d0666584f0b636ca8bc8f82f27133fe162d07fa680e5c3ec455a57d74bec0f0c8
-
Filesize
836KB
-
Filesize
836KB
-
Filesize
4KB
-
Filesize
836KB
-
Filesize
836KB
-
Filesize
836KB
-
Filesize
836KB
-
Filesize
4KB
-
Filesize
836KB
-
Filesize
836KB