Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
19-09-2024 06:03
General
-
Target
eab9324b2da207d67b07a266d78d1c1f_JaffaCakes118.exe
-
Size
661KB
-
MD5
eab9324b2da207d67b07a266d78d1c1f
-
SHA1
9a0bac16eef519363e294185c1f218f5c2897d18
-
SHA256
3b10a594c75f169a89ac0c61f6012acc43036fc13a073006ddbad0e122f0bd77
-
SHA512
07c182101bef3d4c85676c2174041f7ecd087281a247828da40da978abafb18dbbef4f88bebabff2eb11f2847190f60560afd6564fa8534f24c0e00433806092
-
SSDEEP
12288:I0VNfOrKDPWp0bPsYy4+4zF8AzN+QNvjF3Z4mxx4SJiV6Kn3jL:IzV6XyeZNR5QmXLiQKX
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Drops file in Program Files directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies data under HKEY_USERS 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\eab9324b2da207d67b07a266d78d1c1f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\eab9324b2da207d67b07a266d78d1c1f_JaffaCakes118.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Online Services\winlogon.bat"C:\Program Files\Online Services\winlogon.bat"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
51KB
MD57133d3f50200d4d92183849c6bf6d90b
SHA1e7dac7471b67edf5de9e7f5d14c968f451223903
SHA25668c2e172b7f27b2fed4830ae66af900ca11000467f1c485c12dd3a3b4e19acc5
SHA512097abeaadf47f389f1cba1263f4e6eeb8d716a22051d1f62bd8d34046498ee91ab0bc0b4004312171e2754957f940c4372462a472ea149ea27e1e3bc82a8307f
-
Filesize
661KB
MD5eab9324b2da207d67b07a266d78d1c1f
SHA19a0bac16eef519363e294185c1f218f5c2897d18
SHA2563b10a594c75f169a89ac0c61f6012acc43036fc13a073006ddbad0e122f0bd77
SHA51207c182101bef3d4c85676c2174041f7ecd087281a247828da40da978abafb18dbbef4f88bebabff2eb11f2847190f60560afd6564fa8534f24c0e00433806092
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1024KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
12KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
336KB
-
Filesize
1.2MB
-
Filesize
336KB
-
Filesize
336KB
-
Filesize
1.2MB
-
Filesize
72KB
-
Filesize
1.2MB
-
Filesize
336KB
-
Filesize
72KB
-
Filesize
1.2MB