Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
19/09/2024, 02:59
General
-
Target
ea762c38834237df7a7bc3939791f029_JaffaCakes118.exe
-
Size
368KB
-
MD5
ea762c38834237df7a7bc3939791f029
-
SHA1
1fbf0a82ebd23f1dad610c857ddc5cccbf4bb3c5
-
SHA256
fc03665ff805e6abe8b03a4612e2264b266d5916be69ae835d484e7e4c93d416
-
SHA512
c5b0180dbd04c97ec5854596cae52e61dbb74eccb40a371dc7fd06d9c6d1a81b2016ef81c70bc30b86b0755dd891da2b9d6277c71c243a9d504086c5b6d3b9b4
-
SSDEEP
6144:64rN3km/bjDFPVpSRkBwJGjRNWCwNsjtwGIrSEbVDcXfQ4Otooxd7qhMofZh:64h3k4JS+wEXtwGIrhDcXoeoxdIdfZh
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ea762c38834237df7a7bc3939791f029_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ea762c38834237df7a7bc3939791f029_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\iJ01605HlDaF01605\iJ01605HlDaF01605.exe"C:\ProgramData\iJ01605HlDaF01605\iJ01605HlDaF01605.exe" "C:\Users\Admin\AppData\Local\Temp\ea762c38834237df7a7bc3939791f029_JaffaCakes118.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
208B
MD5cf39de40e007caf91a1984456413afd8
SHA14c02346382971a9af44ee929357b2726bc938fd2
SHA256d0ad705140fa3dc79a1756ac9aeb7c66f700c0aa534516af36c33359d3a901cb
SHA5122bb8795c9dab8f57f12934f2e4e99eb3cc8810c86a7161f473fbd25231d9b2970f454d29efd2d112c646724183e78ad9da41867e1657d4339707315ee898d276
-
Filesize
368KB
MD57ae8e2361461eaf4e8ce1bd078139843
SHA14f33e72581444ee4c055566bbf917852b6e227dc
SHA256cbc1dbf4158b0fc3c0be6bf76be31b55031bdaae12ee4b077e9b9c11396c326d
SHA5128a27d5b328b6ed8aa42ff18539179dd47d72d917197e2182c3adde16618c733da1897245170861a90800a970857aef502501cc36a42a4dd56beac80604dce948
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
12KB
-
Filesize
780KB
-
Filesize
4KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB