Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
20/09/2024, 04:58
General
-
Target
ece2773debcffd6e49e7f53df7c2a8c7_JaffaCakes118.exe
-
Size
356KB
-
MD5
ece2773debcffd6e49e7f53df7c2a8c7
-
SHA1
2ebe2906a256bb98208f7fd1c34804c5f2115942
-
SHA256
a19f6b8e49f3ba2ab22e8dd86c24163ec11dd8b092328632b6ee7a4adaac8f85
-
SHA512
ddfaf9653d51ce100ca4b47fd6151cb1e8c4217099005eee2548c30a0a5415ac5c0b82d0db582bef054e9f96a7921f1bfdc65506970c647a6be9efafc7df5252
-
SSDEEP
6144:AGFf3s43omSNcXxswfIFMUMdL2V348hC+VM4HKJuB/Yv4caDufVo2VpzVaP7TjR:AG93s43oLGXVfIFMUM92pkWJrCuaVo2e
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ece2773debcffd6e49e7f53df7c2a8c7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ece2773debcffd6e49e7f53df7c2a8c7_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\cD19701BpFkA19701\cD19701BpFkA19701.exe"C:\ProgramData\cD19701BpFkA19701\cD19701BpFkA19701.exe" "C:\Users\Admin\AppData\Local\Temp\ece2773debcffd6e49e7f53df7c2a8c7_JaffaCakes118.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
208B
MD5009847f7d9b7f87219c788575255f5d7
SHA1107f3c388bba835d9458fc68d8d655f582b4c20a
SHA2569ddc9862b874d4013c04862f5ab26030edadf63a7b013566337088395f59da96
SHA512359f03a59e9c0115c440e7852bbce07e8ec276f82d70ff53727b064b4b57d5c25f0798a2103c344fe38780716cf9dab6b8099903debe1d7862d24e8925014e1e
-
Filesize
356KB
MD5022cdb484a812717fb684ff80ec3cdf7
SHA194cdfe6219006b13bbe096778fb6866fac799025
SHA256c34d6ac825dc05f6025313abf5beada7513604a7485f97b19b5c8df00c873ff2
SHA512d3b43d363d74bc00aa692f95f50d937d803cb266db5ded9767e9a7cab44047dd1ade65368c9009f916ae3d6ade9a753b9ea85a502d224142242f4108befad9f1
-
Filesize
4KB
-
Filesize
836KB
-
Filesize
836KB
-
Filesize
836KB
-
Filesize
836KB
-
Filesize
836KB