Analysis
-
max time kernel
140s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
07-09-2024 10:20
General
-
Target
d1b3d3ef3fcdd83e64ac0b27d0f44770_JaffaCakes118.exe
-
Size
75KB
-
MD5
d1b3d3ef3fcdd83e64ac0b27d0f44770
-
SHA1
ff0d03e0125eadc496935c766abb79ee44b0ad83
-
SHA256
c14f52ec6953779a11aea45a91ef953ce669aa3cb7220df2ddaf25fdcd47d237
-
SHA512
b06eaf895b3a236cbfff79f1077332eabfe9b68975795f5895c696d4e71136ab6ac938fc920be5a6875e5f330be29ce0d50cf39fff3609564f0f2f720246d9fe
-
SSDEEP
1536:nRxmo2Om18CI0KstdVVYnWhh9NuFKblFz+ZEO/UP3y8ZGnMoivsnl8oAAgqEkWj/:nRxmgR0KsvjYKAFIl42OMPBGnMV+hMqy
Score
7/10
Malware Config
Signatures
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d1b3d3ef3fcdd83e64ac0b27d0f44770_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d1b3d3ef3fcdd83e64ac0b27d0f44770_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
244KB
-
Filesize
4KB
-
Filesize
244KB
-
Filesize
4KB