Analysis
-
max time kernel
145s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
19/09/2024, 14:22
General
-
Target
eb845dac85af9331e421e7cdca379a66_JaffaCakes118.exe
-
Size
720KB
-
MD5
eb845dac85af9331e421e7cdca379a66
-
SHA1
0e5345df4ca6ff9a99b8627568450d9cec58312a
-
SHA256
c95b57420c587f6133a8e0055ff014366fe26c6faaf3ea7929cb16191c55c702
-
SHA512
e04ae154cd83056dbd9a30a9faef5271f87234fecc037ca4db4b4cf766f34a0633ff4b5a3a5cc1206e0adf4d44fb503e63b040bc6bdf9cf5e6a8214c4dee0ba3
-
SSDEEP
12288:2BxinS5Sccw6VIwhyKN+fydkhulvzmtyBWhELyYsR/O:2xYhwXwhTdk4latOWzO
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\eb845dac85af9331e421e7cdca379a66_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\eb845dac85af9331e421e7cdca379a66_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Thinstall\{BD1A161E-32AC-494D-80F8-5C88CBF93271}\4000007d00002i\DUTool.exe"C:\Users\Admin\AppData\Roaming\Thinstall\{BD1A161E-32AC-494D-80F8-5C88CBF93271}\4000007d00002i\DUTool.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36B
MD543033b1a64eafd9134eb84c219a424a6
SHA12007050c527020627e70df1b4c1e4753a15b46ba
SHA25622c325955e84711dfad72841fa429b58815e962a3f7f1ef4aa3905ac21423f3b
SHA51255f6e7db62af7335a2966daf433ce0c44af1eddd227093cde83c4ab5cd085a6807bcc364517962fcb2f6c25726afc8f5e1fcf1d8428c7ce0b0c37c1b867a8614
-
Filesize
8B
MD5f6bd6b3389b872033d462029172c8612
SHA1f4533a73e647c710d3ddbfb253de66e1ac8a6891
SHA256f0a0278e4372459cca6159cd5e71cfee638302a7b9ca9b05c34181ac0a65ac5d
SHA5128c7471bddfd31fa1e83a761a2f5bc2fc772a5567c85b3a753d3b8a2e8259386f8f7e440c0ad80272514d821ff27362047e1171b02a95537bd3b40416e5810231
-
Filesize
36B
MD52d9fbdd001fb5f677de63dcd4af9f50c
SHA1e41be3fea91a6520c451286208bb65b4a2cfffe1
SHA256136afe824391acd4259084a2646ed3f5f641e8e1db22ee69e4419fb86ee04ad0
SHA512403c7de6c816352622b889be13f46cb35c75e95f61a540b8077ec36cc56b6f402e4283be64ff7ddb3fe83d7c1a5dce7c038c017d519a1d9d7c404c5ce27801e7
-
Filesize
7KB
MD58d85c336a6d69433f9e97696fdf2cce7
SHA10ff3d590f5e0acbf3b5cb1a73d171608665fcf08
SHA25621a9d96148854b94c6fb08cd2e66abfdfdf15f7802a177aaf125c95c60d3464f
SHA51254ef008e8a894d0362bba0dc1006a8d65969661166aa807d1aee15b1df6fa6ce85718eb26169ad322bf9988ea9a1af4745e4e8a68c7f3612a83d8b73cadcd58a
-
Filesize
640KB
-
Filesize
348KB
-
Filesize
500KB
-
Filesize
500KB
-
Filesize
500KB
-
Filesize
240KB
-
Filesize
500KB
-
Filesize
12.3MB
-
Filesize
1.1MB
-
Filesize
500KB
-
Filesize
1.4MB
-
Filesize
20KB
-
Filesize
1.1MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.1MB
-
Filesize
500KB
-
Filesize
500KB
-
Filesize
1.1MB
-
Filesize
500KB
-
Filesize
240KB
-
Filesize
1.1MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
348KB
-
Filesize
500KB
-
Filesize
12.3MB
-
Filesize
20KB
-
Filesize
64KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
500KB
-
Filesize
640KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
500KB
-
Filesize
1.4MB
-
Filesize
64KB
-
Filesize
1.4MB
-
Filesize
500KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB