Analysis
-
max time kernel
144s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
19/09/2024, 14:22
General
-
Target
eb845dac85af9331e421e7cdca379a66_JaffaCakes118.exe
-
Size
720KB
-
MD5
eb845dac85af9331e421e7cdca379a66
-
SHA1
0e5345df4ca6ff9a99b8627568450d9cec58312a
-
SHA256
c95b57420c587f6133a8e0055ff014366fe26c6faaf3ea7929cb16191c55c702
-
SHA512
e04ae154cd83056dbd9a30a9faef5271f87234fecc037ca4db4b4cf766f34a0633ff4b5a3a5cc1206e0adf4d44fb503e63b040bc6bdf9cf5e6a8214c4dee0ba3
-
SSDEEP
12288:2BxinS5Sccw6VIwhyKN+fydkhulvzmtyBWhELyYsR/O:2xYhwXwhTdk4latOWzO
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\eb845dac85af9331e421e7cdca379a66_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\eb845dac85af9331e421e7cdca379a66_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Thinstall\{BD1A161E-32AC-494D-80F8-5C88CBF93271}\4000007d00002i\DUTool.exe"C:\Users\Admin\AppData\Roaming\Thinstall\{BD1A161E-32AC-494D-80F8-5C88CBF93271}\4000007d00002i\DUTool.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36B
MD543033b1a64eafd9134eb84c219a424a6
SHA12007050c527020627e70df1b4c1e4753a15b46ba
SHA25622c325955e84711dfad72841fa429b58815e962a3f7f1ef4aa3905ac21423f3b
SHA51255f6e7db62af7335a2966daf433ce0c44af1eddd227093cde83c4ab5cd085a6807bcc364517962fcb2f6c25726afc8f5e1fcf1d8428c7ce0b0c37c1b867a8614
-
Filesize
8B
MD5f6bd6b3389b872033d462029172c8612
SHA1f4533a73e647c710d3ddbfb253de66e1ac8a6891
SHA256f0a0278e4372459cca6159cd5e71cfee638302a7b9ca9b05c34181ac0a65ac5d
SHA5128c7471bddfd31fa1e83a761a2f5bc2fc772a5567c85b3a753d3b8a2e8259386f8f7e440c0ad80272514d821ff27362047e1171b02a95537bd3b40416e5810231
-
Filesize
7KB
MD58d85c336a6d69433f9e97696fdf2cce7
SHA10ff3d590f5e0acbf3b5cb1a73d171608665fcf08
SHA25621a9d96148854b94c6fb08cd2e66abfdfdf15f7802a177aaf125c95c60d3464f
SHA51254ef008e8a894d0362bba0dc1006a8d65969661166aa807d1aee15b1df6fa6ce85718eb26169ad322bf9988ea9a1af4745e4e8a68c7f3612a83d8b73cadcd58a
-
Filesize
36B
MD5499a071053b88455f99e472615fec570
SHA1a33cf603d636e1f91ab3f389861acf25b09ef50b
SHA256a34648a0fe9380bbfe27a71da8e121a3bf95d37ff0ee84519b1767c6e1b5129c
SHA51213ded19b3f410eaf8bddb5b5cbaf895720b66ea0ce8068b1b3cf22d214605d6afd49bf8f5cd2a50d5b2cdddb83e63c3b6802f3d4fd408adabc867b9155b8c193
-
Filesize
4KB
MD5bc62e5e28fbf8a336e172b594c3557cc
SHA13dcb3a4114236e10fdc1516806d127b080a34e6b
SHA256c805ee45084108d05730b6339d48b14c6807e9830f1758a512d202c730d94020
SHA512958cfae00c16ee56274c1174ee491f75a76ea1e857d2c6a10eca1cf336426bae0af2e6133d09253096c49ff6dae2378953e82f040cef123ba3a7dc6dd491d13a
-
Filesize
64KB
-
Filesize
1.4MB
-
Filesize
500KB
-
Filesize
500KB
-
Filesize
500KB
-
Filesize
908KB
-
Filesize
1.6MB
-
Filesize
5.7MB
-
Filesize
276KB
-
Filesize
500KB
-
Filesize
1.4MB
-
Filesize
500KB
-
Filesize
64KB
-
Filesize
500KB
-
Filesize
24KB
-
Filesize
144KB
-
Filesize
4KB
-
Filesize
500KB
-
Filesize
1.4MB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
488KB
-
Filesize
144KB
-
Filesize
1.6MB
-
Filesize
5.7MB
-
Filesize
908KB
-
Filesize
500KB
-
Filesize
24KB
-
Filesize
276KB
-
Filesize
500KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB