Analysis
-
max time kernel
141s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
19-09-2024 05:36
General
-
Target
eaaebfb1302b56bc77ba10bead1c1f1c_JaffaCakes118.exe
-
Size
136KB
-
MD5
eaaebfb1302b56bc77ba10bead1c1f1c
-
SHA1
28755462764576db23cabc3c8bdbb474614bcc55
-
SHA256
4c2aeff95b92fd749d71c2420fe428a2fea39b1f51db1ad6e120e3d126e575eb
-
SHA512
48260911756fbbae8b77e0b83db225b65d61d2e0492702aa1ce239776759744e1b59dc0b3054a02a4e3b5c4a773196c169d5c3dbc2fb1566be8809b25304423a
-
SSDEEP
3072:XOK317YNJN6L+RRWRtZhbNqVy+NTH5RGwBlas5rJIIEPN8UTZgujsxdH6Pr1fvIk:Xl7YNJN6L+RRWRtZhbNqVyIRGwBl9rJ0
Malware Config
Signatures
-
Modifies firewall policy service 3 TTPs 4 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\eaaebfb1302b56bc77ba10bead1c1f1c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\eaaebfb1302b56bc77ba10bead1c1f1c_JaffaCakes118.exe"1⤵
- Modifies firewall policy service
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB