Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
19-09-2024 14:34
General
-
Target
eb89bdbf63e9702353b7cad5a5673b1d_JaffaCakes118.exe
-
Size
116KB
-
MD5
eb89bdbf63e9702353b7cad5a5673b1d
-
SHA1
88335f30a5d7dc1d16d1ae46eee400af590ed921
-
SHA256
d87a71b6f987e229e73b61d2eee9dbea1b6480ac438a7d0bc2342856504c0429
-
SHA512
3be74b62c772f83bffdfd57f6109a69ea4095cee7384ba65f77acf12527836fc6ce03714bc4b286ace03228cca99a23dc20f8d4d10f4e82dd2e95b603ca718e8
-
SSDEEP
3072:98RTVXDNJqxSA5HDc3I3nNoOsRXurRUQzj+5f/U:SZRcx5VMpOKXur2Qf+5f
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Drops file in Windows directory 6 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\eb89bdbf63e9702353b7cad5a5673b1d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\eb89bdbf63e9702353b7cad5a5673b1d_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Aparya.exeC:\Windows\Aparya.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2B
MD5309fc7d3bc53bb63ac42e359260ac740
SHA12064f80f811db79a33c4e51c10221454e30c74ae
SHA256ac11339ffa8f270c4f781e0a3922bb1c80d9dee6e4b6911ca34538ed9ae03caa
SHA51277dd27d30f4e13a0bcd6fd27ae7567c136d87393e5ee632bccf05b0a0d2bbcc2fc0fd777a8508e26cc4fc579c8da0ab56b7bf179b1adc70f28f7d0eee89fa5f8
-
Filesize
116KB
MD5eb89bdbf63e9702353b7cad5a5673b1d
SHA188335f30a5d7dc1d16d1ae46eee400af590ed921
SHA256d87a71b6f987e229e73b61d2eee9dbea1b6480ac438a7d0bc2342856504c0429
SHA5123be74b62c772f83bffdfd57f6109a69ea4095cee7384ba65f77acf12527836fc6ce03714bc4b286ace03228cca99a23dc20f8d4d10f4e82dd2e95b603ca718e8
-
Filesize
390B
MD52826eb9e7e6c548d8d519192b23e3ab1
SHA1c0647a9d69eb570d2ad16e55649b3e6f94095d10
SHA25634e529bd07f88fe2157dfb46b05be74ebd3c328036e5d4e8bafd81e389ac38c3
SHA512a660bc546f90440594644e9790ad697e4676d848c04271f725c90222c27bfc198e74f18bff51048a5a84316abe999a73f5bf41a7f390892e3771e1b35717de04
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
140KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
264KB