Analysis

  • max time kernel
    140s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/09/2024, 02:24

General

  • Target

    d582a31536b2c8a07b0d4519397fa404_JaffaCakes118.exe

  • Size

    788KB

  • MD5

    d582a31536b2c8a07b0d4519397fa404

  • SHA1

    7d44b4c67605b06055630c888c4c53db3be683fb

  • SHA256

    2403a935ef110d1db0a912545de6b4278b8bf1ea30b1d3871eccca1718671ae1

  • SHA512

    8b9ef3dc076105ad6d901142ca74d7dcd762f52a3cf5d977d5dc514d8e41a78761915c4a6453a392dab23cdfb25f630effa21385727f2a4646fb653f81b4b036

  • SSDEEP

    24576:8IF89ApyNHHbtg4zzJFpBP/+WbhvzZB8m2iI:8SqyyNHHxgUzpd1hfI

Score
7/10

Malware Config

Signatures

  • UPX packed file 55 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d582a31536b2c8a07b0d4519397fa404_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\d582a31536b2c8a07b0d4519397fa404_JaffaCakes118.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:3872

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\ish240637609\bootstrap_43597.html

    Filesize

    156B

    MD5

    1ea9e5b417811379e874ad4870d5c51a

    SHA1

    a4bd01f828454f3619a815dbe5423b181ec4051c

    SHA256

    f076773a6e3ae0f1cee3c69232779a1aaaf05202db472040c0c8ea4a70af173a

    SHA512

    965c10d2aa5312602153338da873e8866d2782e0cf633befe5a552b770e08abf47a4d2e007cdef7010c212ebcb9fefea5610c41c7ed1553440eaeab7ddd72daa

  • C:\Users\Admin\AppData\Local\Temp\ish240637609\css\main.css

    Filesize

    6KB

    MD5

    e59a57532b1c21d49b6291343e65422e

    SHA1

    ec625dbaa8901412642c0100435434991c26e356

    SHA256

    17478366b4f65029495054354ab5921c821970e54fde6af7f91fd05bb67fc42b

    SHA512

    87a30d0e1c586b038605404c39f838adade62db2cbe3b4bafd6e449573d91833e5b6f0fbf6409c30cf176dc9b46586dea7e1755d42adde76339ae10794dadb6e

  • C:\Users\Admin\AppData\Local\Temp\ish240637609\css\sdk-ui\progress-bar.css

    Filesize

    506B

    MD5

    5335f1c12201b5f7cf5f8b4f5692e3d1

    SHA1

    13807a10369f7ff9ab3f9aba18135bccb98bec2d

    SHA256

    974cd89e64bdaa85bf36ed2a50af266d245d781a8139f5b45d7c55a0b0841dda

    SHA512

    0d4e54d2ffe96ccf548097f7812e3608537b4dae9687816983fddfb73223c196159cc6a39fcdc000784c79b2ced878efbc7a5b5f6e057973bf25b128124510df

  • C:\Users\Admin\AppData\Local\Temp\ish240637609\images\BG.png

    Filesize

    79KB

    MD5

    a31945651b2074873313c82fbc8f9d1b

    SHA1

    fe77de187d8da58d6bdf4b94189318b9fc13ad80

    SHA256

    fadc73a3d095e3d8628c92480d17917547d02b9e6a01294857f4a5a9848fc3a4

    SHA512

    a70a60e071d03f06281bcf868aff23067acd4229e7d4f2ba1a73e34ba7a46180dbfba1545fb2e65948e51c2d9bf1b9f24df730a5fd5b4f319de98a9de323763c

  • C:\Users\Admin\AppData\Local\Temp\ish240637609\images\Close.png

    Filesize

    293B

    MD5

    75a9464e6e2e2d8efc82e5285ab0d95d

    SHA1

    03aa7ccf18666265cef894adc30aede977116405

    SHA256

    7ec62b84d0c741b8e1f4c735ba37fd4dc889690590cf900073793b8d6e44cd0a

    SHA512

    c52d190454e7d6fbafdd18960b5c95cc76da66ce02b7d0caf1eecc3335ae60b8aeb8b014be9adfaf46cafcdb7342029ec265d64576483cfc2b2439a514d9b63c

  • C:\Users\Admin\AppData\Local\Temp\ish240637609\images\Close_Hover.png

    Filesize

    294B

    MD5

    aa5fc77754056e5cf059ae73ae3ffb93

    SHA1

    d6dea0e225dc926506c9c1bc8d9084cbaf7cc350

    SHA256

    cb4b816b428001c2756dc75791598a256ff2774c5dc9e87253ae77b5aaed8da0

    SHA512

    1c61531ed01bd48af185450f64f6a908784a4846085044109cf18f385592f783ae6c9b99cffe95b4d6fc1108fc2cebdfeccca30a01c682f5d47b019429b0e8a6

  • C:\Users\Admin\AppData\Local\Temp\ish240637609\images\Color_Button.png

    Filesize

    1KB

    MD5

    60147e3f18555ea3b6a8aa7f7d5ec4f7

    SHA1

    52b308ab2c723c4a95a1218cf5f6d6d376ae50c9

    SHA256

    b7861c8b3c8aaf75c6b915f9b0fb561949de5625e713970639c9c7f52cc157f9

    SHA512

    e6a3d489bad7122dc81665ca59583401f2c6659aa0f61f969dd64247adce3eeb54719392f13baf09882f3bab6b5f7f28e3f663a1a921997218d4c7f0a29d93f8

  • C:\Users\Admin\AppData\Local\Temp\ish240637609\images\Color_Button_Hover.png

    Filesize

    1KB

    MD5

    97dce4b9ac73486feacecd8b4a3b9186

    SHA1

    c9aa6bf98fcf33e423cac9585f46fb661a2431e0

    SHA256

    72b1ea3e029a939c6fc0851c422787319c61d3b9a1945b82e193ed255fbcdab2

    SHA512

    2a86cbd94333a4750be7a6a53f0e655f4843cd4584eef5c8f8172ba25e88c0fda4f2e7d903d5cd76ed38a714a00305b5a29a620df1ef515b6949578d3108712f

  • C:\Users\Admin\AppData\Local\Temp\ish240637609\images\Grey_Button.png

    Filesize

    1KB

    MD5

    94cff096cae7f90af8db4d4113e5dafb

    SHA1

    bf1daf81dd18c0fc72c403514b2880088549c689

    SHA256

    e6d91d3be5902fdb8f296d54631499df31d8ade6299dd78e902d7578b4d15e18

    SHA512

    29360549eb7a722fd357e6f0ca5d06bddd05ff096e0a8301cf8d14c0195a3b3aed9351a8f2665199ecc9538b5c954738efcffdbd33654868fd2ba8a8355cf9a3

  • C:\Users\Admin\AppData\Local\Temp\ish240637609\images\Grey_Button_Hover.png

    Filesize

    1KB

    MD5

    0430f4b4f794e57c8d2b4b3b8866d2ce

    SHA1

    37d5844d964a4a486d6d3c8687dae03b224e13c6

    SHA256

    84dd580b596a809dc8153a492b2ee8c5f176fed8d2947eab0dc3b3a172efe0c9

    SHA512

    bcf902320766e08d7cb7b4b8c6b84d6533fa593f0e8ce2a799b49c3cff0d49316fee8593587c4010878b83d550d502f6fabe0f4213bd0862dba46480468a60f5

  • memory/3872-175-0x00000000022A0000-0x0000000002412000-memory.dmp

    Filesize

    1.4MB

  • memory/3872-182-0x00000000022A0000-0x0000000002412000-memory.dmp

    Filesize

    1.4MB

  • memory/3872-115-0x00000000022A0000-0x0000000002412000-memory.dmp

    Filesize

    1.4MB

  • memory/3872-114-0x00000000022A0000-0x0000000002412000-memory.dmp

    Filesize

    1.4MB

  • memory/3872-116-0x00000000022A0000-0x0000000002412000-memory.dmp

    Filesize

    1.4MB

  • memory/3872-132-0x00000000022A0000-0x0000000002412000-memory.dmp

    Filesize

    1.4MB

  • memory/3872-145-0x00000000022A0000-0x0000000002412000-memory.dmp

    Filesize

    1.4MB

  • memory/3872-154-0x00000000022A0000-0x0000000002412000-memory.dmp

    Filesize

    1.4MB

  • memory/3872-153-0x00000000022A0000-0x0000000002412000-memory.dmp

    Filesize

    1.4MB

  • memory/3872-112-0x00000000022A0000-0x0000000002412000-memory.dmp

    Filesize

    1.4MB

  • memory/3872-152-0x00000000022A0000-0x0000000002412000-memory.dmp

    Filesize

    1.4MB

  • memory/3872-161-0x00000000022A0000-0x0000000002412000-memory.dmp

    Filesize

    1.4MB

  • memory/3872-162-0x00000000022A0000-0x0000000002412000-memory.dmp

    Filesize

    1.4MB

  • memory/3872-6-0x00000000022A0000-0x0000000002412000-memory.dmp

    Filesize

    1.4MB

  • memory/3872-5-0x00000000022A0000-0x0000000002412000-memory.dmp

    Filesize

    1.4MB

  • memory/3872-2-0x00000000022A0000-0x0000000002412000-memory.dmp

    Filesize

    1.4MB

  • memory/3872-1-0x0000000000400000-0x0000000000416000-memory.dmp

    Filesize

    88KB

  • memory/3872-160-0x00000000022A0000-0x0000000002412000-memory.dmp

    Filesize

    1.4MB

  • memory/3872-171-0x00000000022A0000-0x0000000002412000-memory.dmp

    Filesize

    1.4MB

  • memory/3872-173-0x00000000022A0000-0x0000000002412000-memory.dmp

    Filesize

    1.4MB

  • memory/3872-172-0x00000000022A0000-0x0000000002412000-memory.dmp

    Filesize

    1.4MB

  • memory/3872-174-0x00000000022A0000-0x0000000002412000-memory.dmp

    Filesize

    1.4MB

  • memory/3872-0-0x0000000000401000-0x000000000040B000-memory.dmp

    Filesize

    40KB

  • memory/3872-176-0x00000000022A0000-0x0000000002412000-memory.dmp

    Filesize

    1.4MB

  • memory/3872-177-0x00000000022A0000-0x0000000002412000-memory.dmp

    Filesize

    1.4MB

  • memory/3872-178-0x00000000022A0000-0x0000000002412000-memory.dmp

    Filesize

    1.4MB

  • memory/3872-179-0x00000000022A0000-0x0000000002412000-memory.dmp

    Filesize

    1.4MB

  • memory/3872-181-0x00000000022A0000-0x0000000002412000-memory.dmp

    Filesize

    1.4MB

  • memory/3872-180-0x00000000022A0000-0x0000000002412000-memory.dmp

    Filesize

    1.4MB

  • memory/3872-113-0x00000000022A0000-0x0000000002412000-memory.dmp

    Filesize

    1.4MB

  • memory/3872-184-0x00000000022A0000-0x0000000002412000-memory.dmp

    Filesize

    1.4MB

  • memory/3872-185-0x00000000022A0000-0x0000000002412000-memory.dmp

    Filesize

    1.4MB

  • memory/3872-186-0x00000000022A0000-0x0000000002412000-memory.dmp

    Filesize

    1.4MB

  • memory/3872-187-0x00000000022A0000-0x0000000002412000-memory.dmp

    Filesize

    1.4MB

  • memory/3872-188-0x00000000022A0000-0x0000000002412000-memory.dmp

    Filesize

    1.4MB

  • memory/3872-189-0x00000000022A0000-0x0000000002412000-memory.dmp

    Filesize

    1.4MB

  • memory/3872-192-0x00000000022A0000-0x0000000002412000-memory.dmp

    Filesize

    1.4MB

  • memory/3872-193-0x00000000022A0000-0x0000000002412000-memory.dmp

    Filesize

    1.4MB

  • memory/3872-194-0x00000000022A0000-0x0000000002412000-memory.dmp

    Filesize

    1.4MB

  • memory/3872-195-0x00000000022A0000-0x0000000002412000-memory.dmp

    Filesize

    1.4MB

  • memory/3872-196-0x00000000022A0000-0x0000000002412000-memory.dmp

    Filesize

    1.4MB

  • memory/3872-197-0x00000000022A0000-0x0000000002412000-memory.dmp

    Filesize

    1.4MB

  • memory/3872-199-0x00000000022A0000-0x0000000002412000-memory.dmp

    Filesize

    1.4MB

  • memory/3872-200-0x00000000022A0000-0x0000000002412000-memory.dmp

    Filesize

    1.4MB

  • memory/3872-201-0x00000000022A0000-0x0000000002412000-memory.dmp

    Filesize

    1.4MB

  • memory/3872-202-0x00000000022A0000-0x0000000002412000-memory.dmp

    Filesize

    1.4MB

  • memory/3872-203-0x00000000022A0000-0x0000000002412000-memory.dmp

    Filesize

    1.4MB

  • memory/3872-204-0x00000000022A0000-0x0000000002412000-memory.dmp

    Filesize

    1.4MB

  • memory/3872-208-0x00000000022A0000-0x0000000002412000-memory.dmp

    Filesize

    1.4MB

  • memory/3872-209-0x00000000022A0000-0x0000000002412000-memory.dmp

    Filesize

    1.4MB

  • memory/3872-210-0x00000000022A0000-0x0000000002412000-memory.dmp

    Filesize

    1.4MB

  • memory/3872-211-0x00000000022A0000-0x0000000002412000-memory.dmp

    Filesize

    1.4MB

  • memory/3872-212-0x00000000022A0000-0x0000000002412000-memory.dmp

    Filesize

    1.4MB

  • memory/3872-213-0x00000000022A0000-0x0000000002412000-memory.dmp

    Filesize

    1.4MB

  • memory/3872-215-0x00000000022A0000-0x0000000002412000-memory.dmp

    Filesize

    1.4MB

  • memory/3872-216-0x00000000022A0000-0x0000000002412000-memory.dmp

    Filesize

    1.4MB

  • memory/3872-217-0x00000000022A0000-0x0000000002412000-memory.dmp

    Filesize

    1.4MB