Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
19/09/2024, 03:28
General
-
Target
ea805757e253af3dd31df939c195802b_JaffaCakes118.exe
-
Size
164KB
-
MD5
ea805757e253af3dd31df939c195802b
-
SHA1
65961aa52ac859f11be9955df506b72ffc964d2d
-
SHA256
9b71702e10ecfe84b52dc6cc7c5ffc25ab61ddfa3003b4e12035a6578cc4d9e6
-
SHA512
2c2b961932360495ee146ab4218bc53237cd4a0901948c2bfe382b70962bcf68d2c1ab4ab871a93d735af431716fe7e4782e9bc62187c7dd02c72b5d7c602072
-
SSDEEP
3072:7rBupLDVE6xErnRJrf2f6JeZvjEAvQkwUyD2xfGUXIEk5SPEX7o:RmW6UtYRIAYkNyGfGZLo5
Malware Config
Signatures
-
Drops file in Drivers directory 4 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 6 IoCs
-
Suspicious behavior: LoadsDriver 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ea805757e253af3dd31df939c195802b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ea805757e253af3dd31df939c195802b_JaffaCakes118.exe"1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
90KB
MD5ec027f4e03773ef27ccf79cbacd4fa34
SHA1eeeb3f8a1dc876f1bb573e5497e1b6719cf661c5
SHA256c105afe3f91cc5c971ee9a83bbb43cdaba4ced00b1c2c9eecbaf01363e3ca928
SHA51224a061c86de7b668177e5bcde756d0212bf6bc206debd7d613d37e1f57e2fb3d9c87cb4d469b0907126d03f171e4aac65f988967237f8fb3fc4bdbb6699dd2c4
-
Filesize
58KB
MD5ee5db68a4d6b6a7015ba2714543542eb
SHA1126590ed7bf005f2390d68eb55d7aa71c54a4b0f
SHA2565f2863f087cd452b0944c97c91f3cd5817689c7b96fb1b7062b54a85fa6a83cc
SHA512bc138ecb05cf9f9e992ace9f8cef5f6a1c5f02d09e0b19af444d4b992026ecc0f8c1d69df62416f44ded3973b6d6720062450fc7cb07d4e05bfc8cd3f78e4f53
-
Filesize
232KB
-
Filesize
220KB
-
Filesize
220KB
-
Filesize
220KB
-
Filesize
180KB
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
232KB
-
Filesize
180KB
-
Filesize
84KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
220KB
-
Filesize
180KB
-
Filesize
84KB