Analysis
-
max time kernel
140s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
21-09-2024 11:47
General
-
Target
efb9be74da032f5cc9606c7330ebfd6b_JaffaCakes118.exe
-
Size
20KB
-
MD5
efb9be74da032f5cc9606c7330ebfd6b
-
SHA1
3c37166975f2faf3ff7fec7733eb24e6c480e3a4
-
SHA256
5ca65b5f3a27e0092737901e29c94186c225908946aa35d51e4662f5557d901d
-
SHA512
c3bc9748ea493b34cba779ec0e51a9b51c0840bd072f48c14c9afc76f6cc8356b876032c61536f797170f8c68354918a47ac3f1a5f3ac6e8750cbf177dff449a
-
SSDEEP
384:V6J6rTtn0/nZAQYhU81y7su1cKYyCA+rsR07Q7aCB5X0B:5on2Qi1ZYHYyY1YaCDkB
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
-
Loads dropped DLL 2 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\efb9be74da032f5cc9606c7330ebfd6b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\efb9be74da032f5cc9606c7330ebfd6b_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16KB
MD529bf3de5dc22f5f7f81b04f08403d98a
SHA115a15f1b6ef38a9360c3d56bb0f714943f65b93b
SHA256434760bed1359884eefcf842ec59d119d7edf36ac35db1c5de1181b1ba2bde09
SHA51218b4a31e9176271e686f6e66931ce506a4679bf56b541328ea8681abc8fe82819970a1a9f60737ab67bf13e363ff2d5580b36011ea066575ae27ec1fa8ecf6dd
-
Filesize
100KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
100KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB