Analysis
-
max time kernel
140s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
19-09-2024 05:27
General
-
Target
eaab7858ee68fef371d269c5f29ac42e_JaffaCakes118.exe
-
Size
1.8MB
-
MD5
eaab7858ee68fef371d269c5f29ac42e
-
SHA1
375d1116acd741fa35c3491da1191fb4c053dd30
-
SHA256
067a096b7dbb8efc36d920c001f9fc332f468d439b071fe6fb6a464879776b94
-
SHA512
bb3bf338e68ba53b9b58c5983987f39f160c887d992ed29d0cfb61c35aa0b5490a8b8cf9629f2e16306592456f4dac676c99898991d61e5f2dd61d872376298c
-
SSDEEP
49152:KpqyOqAiCA4KQ7iIe3XHBQ440lLq7Gid4TG3U:Kpqy5v4KeEXHG4476I4
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 6 IoCs
Detects file using ACProtect software.
-
Loads dropped DLL 29 IoCs
-
UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\eaab7858ee68fef371d269c5f29ac42e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\eaab7858ee68fef371d269c5f29ac42e_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD555788069d3fa4e1daf80f3339fa86fe2
SHA1d64e05c1879a92d5a8f9ff2fd2f1a53e1a53ae96
SHA256d6e429a063adf637f4d19d4e2eb094d9ff27382b21a1f6dccf9284afb5ff8c7f
SHA512d3b1eec76e571b657df444c59c48cad73a58d1a10ff463ce9f3acd07acce17d589c3396ad5bdb94da585da08d422d863ffe1de11f64298329455f6d8ee320616
-
Filesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
Filesize
289KB
MD521ace3cf64828557817cb17f55e4dfd1
SHA146574d7a5483db8476bd607340cc441a326dcf14
SHA2562d1becb94d82d890662ffd0cd99b6004e31a4633bba8e950f79610907761e7ab
SHA5121f8b8c077ac814c4570794b7e324fd2125a187934d4ce59886e2940141e93aff020cf3cfdeb9dbc5f0a62d76f502af6018f05659d285a87a3dfddb1b77a37ef2
-
Filesize
6KB
MD5f8462e9d1d7fd39789afca89ab6d6046
SHA17e9a518e15b7490245d2bef11a73f209c8d8d59b
SHA25648941e9f5c92a33f1e60a7a844d562dd77ce736fd31b5503c980b49679dfe85e
SHA51257dee2253abd7d17d53811d5e95237f9434288518fb043645524a517786db2d8a91df86a6da732c620f12ad0e7ea30a923b8d5f3de386c65bd3ff240bc0dff69
-
Filesize
9KB
MD5c10e04dd4ad4277d5adc951bb331c777
SHA1b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
SHA256e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
SHA512853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
-
Filesize
6KB
MD5ebc5bb904cdac1c67ada3fa733229966
SHA13c6abfa0ddef7f3289f38326077a5041389b15d2
SHA2563eba921ef649b71f98d9378dee8105b38d2464c9ccde37a694e4a0cd77d22a75
SHA512fa71afcc166093fbd076a84f10d055f5a686618711d053ab60d8bd060e78cb2fdc15fa35f363822c9913413251c718d01ddd6432ab128816d98f9aabf5612c9f
-
Filesize
48KB
-
Filesize
4KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
40KB
-
Filesize
48KB
-
Filesize
4KB
-
Filesize
40KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
4KB