Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
19/09/2024, 03:13
General
-
Target
ea7ac470b569370d17dd5f28953072a8_JaffaCakes118.exe
-
Size
501KB
-
MD5
ea7ac470b569370d17dd5f28953072a8
-
SHA1
faa5be3fc0dd21020abeea5364a5d0f360bd2320
-
SHA256
4611a65a5abdb83ec10940b9cf4f27bc21e2d0d9d81f46bce4ce965fb7010459
-
SHA512
99fe960961517d47b1fc7dffdbe8ea8eacbc3b1ae540a1a54eee2a9efd5bab4a21dac7f447579137ec86868388d5c692e8e2c82562e9a4844a5dd97d54c51396
-
SSDEEP
12288:IQeZEM4aLzp5uUU7d3OnsJBhiYzeZjfv+38qXAdUFu6:I5v+FOsJLZYvt06
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ea7ac470b569370d17dd5f28953072a8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ea7ac470b569370d17dd5f28953072a8_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\cL28601HjDiA28601\cL28601HjDiA28601.exe"C:\ProgramData\cL28601HjDiA28601\cL28601HjDiA28601.exe" "C:\Users\Admin\AppData\Local\Temp\ea7ac470b569370d17dd5f28953072a8_JaffaCakes118.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192B
MD5fbd4cdc570a16f8efdb98098fa2537e3
SHA157c06393ed6a4d07e086b47217cb9a38f7955934
SHA256da7f035bf16704f0018665e421a38fa4abbebc2010bddcc3176ceeef830f07b0
SHA5126bcb4702211e2d40d62f3210599f6598a1d70f7953f7489838f85025b8680535a07334df4341c43966de4d8a3c4ff6b419e8005ca4f8b767b18087994bca376e
-
Filesize
501KB
MD5fd3acd3de1d47bd22d5689d63465b4ec
SHA1e22a29cf3306ef8fbb9896429a3c583cbb52ade5
SHA2567f4f3f3da51101d5ddb9b7bb350fd4469ec489854a51cf04b9c40fb505b94b98
SHA512bf17b379c2ced2ac1b08816d0718d9602c3a6720525fec088ec7f4cdf5cce397197ca066d355895ee58314c84cd5fb143d3a29f1bb56e3f34abac41762b2222c
-
Filesize
788KB
-
Filesize
828KB
-
Filesize
788KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB