Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
11/09/2024, 05:39
General
-
Target
d9b71ecaee506fbea2b6b266853ea0f3_JaffaCakes118.exe
-
Size
80KB
-
MD5
d9b71ecaee506fbea2b6b266853ea0f3
-
SHA1
2caa7031b77732d9d5a7e26ddc680ebc91b2063b
-
SHA256
970a99c82208ffa6232860f8185977b80356f5d1876ccb7f4063e1c51cc4db23
-
SHA512
7a7d7659b721d02c332d5ea4447f29674032f2c02b9e6468dd56052a0631fd23a08ea052e4f32984d2a57655d1a4f5eaf2e66c80bd0a17461e6f1edd8b84b501
-
SSDEEP
1536:XjnWU65Sn8VUemzRAQeQZlF+mxlBQgptzvRnfYXtegbTDpZmeMFcexqmo:bWcnCmNAQeQZlF+60WtzvRKtXcF2m
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Drops file in System32 directory 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d9b71ecaee506fbea2b6b266853ea0f3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d9b71ecaee506fbea2b6b266853ea0f3_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\KERNEL32.exeC:\Windows\SysWOW64\KERNEL32.exe1⤵
- Executes dropped EXE
-
\??\c:\windows\mfc42.exec:\windows\mfc42.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
133KB
MD52340ecc6861452a16f21e11e1ef1f68b
SHA1bb5be864b24cbfdcb46f13449f189ef2948cc6fd
SHA25607247865c65d132e4585a491e826b182495cb5e02116cd1de620f42238fdb5fb
SHA51206db653b0a47ce63277dab4055d0577095140b38f2002a30a3a83de2ab91710b472d4d79ee125ac1f0df7b8fbc0fd515bfd3f3207905109b22e301de188d597d
-
Filesize
56KB
MD5bf450a139ead7690cdad83f6b8b8bbeb
SHA19c98cd6f897c912f18cf1270ca9f212c89ef7d6c
SHA25609cf91acc6f5696ca3916b3f83c0652d1819d0ef1a51b62b67c05549b8cb50ab
SHA5129a7208338a20ec8f534bf21433854484bb581b7c18bb4639a6b8482cace221324b9f241b85308d4f69087a3203825f55cae1d8bb715bb7b44d753e101ace5cd0
-
Filesize
372KB
-
Filesize
372KB
-
Filesize
372KB
-
Filesize
220KB
-
Filesize
220KB
-
Filesize
220KB
-
Filesize
220KB
-
Filesize
220KB
-
Filesize
220KB
-
Filesize
220KB
-
Filesize
220KB
-
Filesize
220KB
-
Filesize
220KB
-
Filesize
220KB
-
Filesize
220KB
-
Filesize
220KB
-
Filesize
88KB
-
Filesize
88KB
-
Filesize
88KB
-
Filesize
88KB
-
Filesize
88KB
-
Filesize
88KB
-
Filesize
88KB
-
Filesize
88KB
-
Filesize
88KB
-
Filesize
88KB
-
Filesize
88KB
-
Filesize
88KB