Analysis
-
max time kernel
94s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
14-09-2024 02:02
General
-
Target
df4a9f5ee46bc52a7bb2b74b40d63f91_JaffaCakes118.exe
-
Size
38KB
-
MD5
df4a9f5ee46bc52a7bb2b74b40d63f91
-
SHA1
3be6099b9d200248af319c16b0a310e091ff3cec
-
SHA256
b409b74d07d372f2d645ffe3aee93b25ec04fac6e16bbd3a5c15c9ede5e0f4ba
-
SHA512
855455a548f08c32ce2153e9ca14353c0874623e90e9dc6045dd1bb23bf5de99759384c33d6e76e7aca69f386e0f10ff3a40ea6f985346cea1e1fd2256e9961f
-
SSDEEP
384:Ohu//BkfGN15yrdjI+cRy2APBsLf45kSyf8K7MPZv9TwhMJqILDU0jMK2X3lyq4Y:bBkeNeXdt5ADCwSqab2Xd4Y/ik
Score
10/10
Malware Config
Extracted
Credentials
Protocol: smtp- Host:
smtp.gmail.com - Port:
587 - Username:
[email protected] - Password:
tamereenshort2
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\df4a9f5ee46bc52a7bb2b74b40d63f91_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\df4a9f5ee46bc52a7bb2b74b40d63f91_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
664KB
-
Filesize
9.6MB
-
Filesize
4.8MB
-
Filesize
9.6MB
-
Filesize
624KB
-
Filesize
32KB
-
Filesize
304KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
4KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB