Analysis
-
max time kernel
139s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
09/09/2024, 16:06
General
-
Target
d6a9846687363e09f916dddd227ad0a1_JaffaCakes118.exe
-
Size
160KB
-
MD5
d6a9846687363e09f916dddd227ad0a1
-
SHA1
bbf2583a8b1ef356fc501443be6782917a3e3a0d
-
SHA256
07672d42b6193904bde4d17241813b1b590c219622f535127980105c98a98c32
-
SHA512
efddea9c2ff4adc018d7abb70ccca6341c12016cb30255db4a625797adf5240386cf2ef06ca7a6117f7cda8cff8bdf993a88cc7d08fd18c00c2811db39e353d0
-
SSDEEP
3072:gaGhtzrAxhQBLU9CJNE/FTDxFBm43TwrbiZntpzZMGz0jStpdd:8hNsgg9CJyDwkTwktPMLG
Malware Config
Signatures
-
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Loads dropped DLL 1 IoCs
-
Unexpected DNS network traffic destination 5 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\AppData\Local\Temp\d6a9846687363e09f916dddd227ad0a1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d6a9846687363e09f916dddd227ad0a1_JaffaCakes118.exe"2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD5bfa0c9ec67cd0f1b2dabfc7777aae294
SHA1c15a4686bda91546e4c3abba58530423c40da3dc
SHA256f3a8ac1721abb9068c5c281dafeaebdf3a66f96954c9e882ef71dee9c44bc585
SHA512e2e7b989e17dcf2f0c2b93e53671a6f34230b31b0daa152fd9ec84aa14055b1350960d5dbc7da02a03d4eda7c68f9082f6c8be053ec56c0bed5b2bd0ef38556f
-
Filesize
4KB
-
Filesize
184KB
-
Filesize
16KB
-
Filesize
4KB
-
Filesize
184KB
-
Filesize
184KB
-
Filesize
184KB
-
Filesize
16KB