Analysis
-
max time kernel
141s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
11/09/2024, 12:39
General
-
Target
da5e02a40ca65a850771fbac3637ea65_JaffaCakes118.exe
-
Size
596KB
-
MD5
da5e02a40ca65a850771fbac3637ea65
-
SHA1
c5be57d04ca54e09adbe6068f10da4ada79482b5
-
SHA256
b91b7c47d4cb0269d816c72e875ff2a2978776c1a90f0d1a6143fdf16068562d
-
SHA512
c0dd56873844d86148efe655256635864e8be7144d6993553d6f89be36fe8e8f9186e3738b8096eda4a8c8177a83903cbdc90284d16bd14adec00cf87894b77f
-
SSDEEP
12288:PKfOyy65vkNRrwvQFmqUBX1KZTY1bOB1f4KfTKk+9UqGJ+e5PHtHT7jDLG:yq62UIFmJhoao4KOk+lGJzxT7jG
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Windows directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 16 IoCs
-
Suspicious use of SendNotifyMessage 8 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\da5e02a40ca65a850771fbac3637ea65_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\da5e02a40ca65a850771fbac3637ea65_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\A.exe"C:\Windows\A.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\y666..exe"C:\Windows\y666..exe"3⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Windows\Ÿêí¢_ Ÿé¬...3gp"2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
208KB
MD57316f87097e132b37abd0545cc92e580
SHA18dcbc9c931e4e14105229a8737e7a822acdc6649
SHA256158c07f7f64463c596b524ead388d9d404959cff16502eb31f0687be9185bfaf
SHA512ab4defc28a1364ec949b700ef57331f30de78145fc7549993c49374c270d609f2803a308eba957e22458ab35bdecae52c8ab1acf00b5f52717ebc0cb6ea69b73
-
Filesize
343KB
MD5081122ed0211ab566a07acbf6712f5db
SHA11d28ec2963c2801bc5d9667693e1d3edfbcfba26
SHA256600192c1efc9de9ddf90cc945841b1a66baad502ea5f027bd293a1bf35505bf7
SHA512e1e198a8c447396461cca575214365e78b575c966dc8196e3d90d5513f2a00e1be4ff62192e19ea3d2ce731bc2f88b96d9a01f8b3cd4f2b78171b8d100a6fd01
-
Filesize
370KB
MD5942a979612d09038baec65e04cedd42d
SHA14d856a9704ee9f7d8d34ba4c345a4df4077500e6
SHA256dff0bcb7cff46a003ca02a823173430d0d1dadca379424a48e7a735ceb9093e6
SHA512d8434a59f44f169c4fb3ea6c1b07ab87fa504e9b09f08470446cc5c29223536770df66828230c5d287c9e50614f689cf3a174a10fc20d1cf6ed24ed768678bc1
-
Filesize
416KB
-
Filesize
416KB
-
Filesize
2.0MB
-
Filesize
92KB
-
Filesize
992KB
-
Filesize
116KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
16.7MB
-
Filesize
2.7MB
-
Filesize
92KB
-
Filesize
96KB
-
Filesize
260KB
-
Filesize
132KB
-
Filesize
96KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
108KB
-
Filesize
68KB
-
Filesize
96KB
-
Filesize
192KB
-
Filesize
412KB
-
Filesize
496KB
-
Filesize
68KB
-
Filesize
348KB
-
Filesize
208KB
-
Filesize
24.4MB
-
Filesize
2.7MB
-
Filesize
1.5MB
-
Filesize
72KB
-
Filesize
64KB
-
Filesize
308KB
-
Filesize
264KB
-
Filesize
2.0MB
-
Filesize
68KB
-
Filesize
88KB
-
Filesize
188KB
-
Filesize
264KB
-
Filesize
788KB
-
Filesize
392KB
-
Filesize
436KB
-
Filesize
84KB
-
Filesize
140KB
-
Filesize
76KB
-
Filesize
1.0MB
-
Filesize
68KB
-
Filesize
92KB
-
Filesize
68KB
-
Filesize
388KB
-
Filesize
284KB
-
Filesize
208KB
-
Filesize
464KB
-
Filesize
624KB
-
Filesize
416KB
-
Filesize
416KB