Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
20-09-2024 21:48
General
-
Target
ee7c6a176aac201910ae09691fc21fea_JaffaCakes118.exe
-
Size
151KB
-
MD5
ee7c6a176aac201910ae09691fc21fea
-
SHA1
e803eaa95783f0c7d45044089eb1ed813a0ac0ff
-
SHA256
f2fe1675619eba55dadbea2aa661f467fdf311766bf7e4771082435c7a314b1c
-
SHA512
5b9a4b3130152d40c4eb5ad3eb884a18a08090f110157fb505e6dc44dcf3dd4351cacceae81bff792de5c3a60fd8c97d20f7ac8a8eb2be284481de7c7213dabf
-
SSDEEP
3072:6tkEoAWF4ZCD4OnYQqD841ZMImdKYRlBKgwtrlVw:6tkEoAM4iYQqA4fDmdKWHmro
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops autorun.inf file 1 TTPs 3 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in Program Files directory 2 IoCs
-
Drops file in Windows directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Office loads VBA resources, possible macro or embedded object present
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee7c6a176aac201910ae09691fc21fea_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ee7c6a176aac201910ae09691fc21fea_JaffaCakes118.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft Office\Office14\winword.exe"C:\Program Files (x86)\Microsoft Office\Office14\winword.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD5ea27992610dc878ff3a07c075fa1d6ed
SHA1b3e3d4c5f2a05d61d35ebc7c5b8a67813941ada4
SHA2567077010fecdf7dc92a56b3730f98d41ebf826938ab678e2c49f421e9c0545f2d
SHA512539aab8350421b045e92dc2aa89c3645e88740e5e41e9cd90f2b37f819010c3a68aa38ff1bb5a0a512a7db19c86ebfd2f04081e88e20a99bb2e8fbe8a159a4d9
-
Filesize
126B
MD5163e20cbccefcdd42f46e43a94173c46
SHA14c7b5048e8608e2a75799e00ecf1bbb4773279ae
SHA2567780bee9df142a17e0457f3dcb2788b50fc2792370089335597d33719126fb7e
SHA512e5ac0ff6b087857799ab70f68067c9dc73eeb93ccfcad87047052380b95ade3e6eb2a7d01a0f850d548a39f4b1ebb60e299d603dbe25c31b9a3585b34a0c65a8
-
Filesize
151KB
MD5c57878cd0969d029688cbc7ece99799f
SHA1c7ba03bf88d6b1c6ed9c26860877e6d1235424aa
SHA2560aee572ea00982078392535f44720a0b97c36bc5f311d9dc1556b8d933cd2467
SHA512d2d7183c3d7f5e3abd54f7775f451e2aefc04d73fcce91e6496444aefca2bc6ecb8192fd36a6d59039d949803cb4c341608c1b0846c6bb79ce8b870d6db9ed88
-
Filesize
151KB
MD58244d34264932f131c557472ae7c4439
SHA1def7057cf8c1d6dad66286685c612ce7555cd648
SHA256480266d238c9eb17666131b4ffbe73bd0653cb5dd7b56c7e27a3ca0bc0669b79
SHA5127bb9f2e5e92a86c5a8e0538d37fe75ac5db3cc2524f2ed83d4bcef190bfc40a4d541c80123408b790c3f78135d6466375ba1e9481c24c4dcc668a002ecbbca5f
-
Filesize
88KB
-
Filesize
88KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
64KB