Analysis
-
max time kernel
150s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
15-09-2024 01:23
General
-
Target
e16d2a688be1d485ccade3e6e438046f_JaffaCakes118.exe
-
Size
445KB
-
MD5
e16d2a688be1d485ccade3e6e438046f
-
SHA1
44c0a2134dc98725466a7630f6b0732d08e714c6
-
SHA256
d01901239b4a6e572eb79f781c66d199ddcea801ea34d7ba31019f2f195a074d
-
SHA512
6d014e00dc3287b04a1214cd4ffd42716b57b8ac2fc693152eb05f42e40b385db42bc3ae5b9e2c4d2ef72a8e37acdd65b56f8bb2908d5dcda14fe553745f8c46
-
SSDEEP
6144:DOeNjg93bZLRYMRL6mNIFRrJJZZHKEAtOi30FW141Hbvc0ffl7sz3BD896tbSYpC:Dr4V36LaEAtkk4hYilsNw90Oe30B
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 10 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e16d2a688be1d485ccade3e6e438046f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e16d2a688be1d485ccade3e6e438046f_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\kFeBaLb01806\kFeBaLb01806.exe"C:\ProgramData\kFeBaLb01806\kFeBaLb01806.exe" "C:\Users\Admin\AppData\Local\Temp\e16d2a688be1d485ccade3e6e438046f_JaffaCakes118.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
445KB
MD5ae0b89c8c597c57f79bff1e4d6504f1d
SHA106850b7c4a2250dd5498f2663a3fccc7826bb613
SHA256f69ccbfb35b642125d0cf175e34ed5feb0d71cf1ab9c5b4b4cbdc0ca144fc268
SHA5123f1d3f1d8a6200d5f9d6898db0b0f87a1234fb4091166e37f52ffe5e6d5d551139fd2576a9a58181f09acc4faa2cce0a9db52d8e78963a6f1bfc259272963166
-
Filesize
748KB
-
Filesize
316KB
-
Filesize
628KB
-
Filesize
716KB
-
Filesize
748KB
-
Filesize
748KB
-
Filesize
748KB
-
Filesize
716KB
-
Filesize
716KB
-
Filesize
748KB
-
Filesize
748KB
-
Filesize
748KB