Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
20/09/2024, 20:34
General
-
Target
ee60777f81328a16b5338689f732c22e_JaffaCakes118.exe
-
Size
1.4MB
-
MD5
ee60777f81328a16b5338689f732c22e
-
SHA1
463ffbaddc36bdc8d061d904ddb640064318e84a
-
SHA256
449a71cfa1488eadcf01ecef8efb61b3f8c0711377b52505cb34ac6064bea1d5
-
SHA512
707e714f643cdb92a3ff7bfbf9d59f1fc2a818f5d851170161726aa500d9ba98bea7253db559df614402d94ef404622f90cbe15575b42bfa1f82d3d8fe5c35db
-
SSDEEP
24576:yPPIEkFkM/k9CPB0LzFh5AHizW6UUCuVddinQ3ko4gBsf+XspgD8PKpBIl4:VfFkV9Can9MP9U5dinDo4gBL8uiKpqi
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 3 IoCs
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops autorun.inf file 1 TTPs 3 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in Program Files directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee60777f81328a16b5338689f732c22e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ee60777f81328a16b5338689f732c22e_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Documents and Settings\tazebama.dl_"C:\Documents and Settings\tazebama.dl_"2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
126B
MD5163e20cbccefcdd42f46e43a94173c46
SHA14c7b5048e8608e2a75799e00ecf1bbb4773279ae
SHA2567780bee9df142a17e0457f3dcb2788b50fc2792370089335597d33719126fb7e
SHA512e5ac0ff6b087857799ab70f68067c9dc73eeb93ccfcad87047052380b95ade3e6eb2a7d01a0f850d548a39f4b1ebb60e299d603dbe25c31b9a3585b34a0c65a8
-
Filesize
151KB
MD571e54c4ca48997553a2d551a5b000de2
SHA1af055e23c603932bd6659eb99d4a3c46576a7499
SHA256d29f2d8b8659d2dbc60e94a505ddb40514317f1f70afd0230bb753767d8dcdc5
SHA512dcc06ab9b50f8db288eba8843427f3a39adc86c0ec6322706408172df8f0d9b94ade709fde6266b7c5cd970fe43806d11b1dc8d86d3403b7c68b49914ff3e576
-
Filesize
151KB
MD59f266479d22f8f0f74ae13e167847d44
SHA1f0c7f2befa62c118d0989fe82f84ce44ae6cc2da
SHA256c148f55ab08e46411ee4eae7fca72e941ee8191d8d4c6387af64be3326289caa
SHA512184390c3489cc667c7a39c2109e246798caa71db5c4538bbc013401118134549589af7f0df6fa62617b16e4e236ec6fd8111fb442c6e96e89c7b1a4cf1a185ad
-
Filesize
151KB
MD513eb8619af6ec85433de56a79af5fdd3
SHA10ba74e06d16f4367e2dba1fcd61279afe2a8c547
SHA256bef9e48f9d1208fe0c37009e3de7c6809e26f217f89e1aa396ae1296541a9007
SHA51229e463a10a083e83a4ffc75c64e89de0a4275f4257fd22c52aaf06e59e04a7df01e9e9616b025cbd1db9c9e9781bd1620982733109284119f50fa37923d9df3e
-
Filesize
32KB
MD5b6a03576e595afacb37ada2f1d5a0529
SHA1d598d4d0e70dec2ffa2849edaeb4db94fedcc0b8
SHA2561707eaf60aa91f3791aa5643bfa038e9d8141878d61f5d701ebac51f4ae7aaad
SHA512181b7cc6479352fe2c53c3630d45a839cdeb74708be6709c2a75847a54de3ffc1fdac8450270dde7174ecb23e5cb002f8ce39032429a3112b1202f3381b8918c
-
Filesize
1.3MB
-
Filesize
88KB
-
Filesize
48KB
-
Filesize
1.3MB
-
Filesize
48KB
-
Filesize
88KB
-
Filesize
88KB