Analysis
-
max time kernel
150s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
09/09/2024, 22:00
General
-
Target
d72a277b30ef3604b4b2e78dd21512bd_JaffaCakes118.exe
-
Size
70KB
-
MD5
d72a277b30ef3604b4b2e78dd21512bd
-
SHA1
258c27a3aa9f631621ef82136524e2df91374c9a
-
SHA256
e7c65fb736f4ec9a78be81c8b7611cb548285b7021b72d9659d0708ad3ccf748
-
SHA512
21c6f5ec2934137a78d9aee95831c42d69b5186adaf0c9eb963597e01f27666152f470eec45e9d94d36940d2f9b0968b25edb314c0994a27641bfbbc9399f5fc
-
SSDEEP
1536:I+0gFMj1AaiN7OaM1C9rRtpl8XcFYINoIadoqEXrY:rNDaiN7ORC9rvwXcFH6yrY
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Modifies firewall policy service 3 TTPs 2 IoCs
-
Disables RegEdit via registry modification 1 IoCs
-
Disables Task Manager via registry modification
-
Drops file in Drivers directory 1 IoCs
-
Deletes itself 1 IoCs
-
Executes dropped EXE 2 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d72a277b30ef3604b4b2e78dd21512bd_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d72a277b30ef3604b4b2e78dd21512bd_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\mscarrt32.exeC:\Windows\mscarrt32.exe 160 "C:\Users\Admin\AppData\Local\Temp\d72a277b30ef3604b4b2e78dd21512bd_JaffaCakes118.exe"2⤵
- Modifies WinLogon for persistence
- Modifies firewall policy service
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Deletes itself
- Executes dropped EXE
-
-
C:\Windows\mscarrt32.exeC:\Windows\mscarrt32.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD5d72a277b30ef3604b4b2e78dd21512bd
SHA1258c27a3aa9f631621ef82136524e2df91374c9a
SHA256e7c65fb736f4ec9a78be81c8b7611cb548285b7021b72d9659d0708ad3ccf748
SHA51221c6f5ec2934137a78d9aee95831c42d69b5186adaf0c9eb963597e01f27666152f470eec45e9d94d36940d2f9b0968b25edb314c0994a27641bfbbc9399f5fc
-
Filesize
184KB
-
Filesize
184KB
-
Filesize
184KB
-
Filesize
184KB
-
Filesize
184KB
-
Filesize
184KB