Overview

overview

10

Static

static

10

f53e4af30a...18.exe

windows7-x64

6

f53e4af30a...18.exe

windows10-2004-x64

6

Analysis

  • max time kernel
    132s
  • max time network
    132s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    25/09/2024, 05:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    f53e4af30ac4c2a9bd7ecb252cdde389_JaffaCakes118.exe

  • Size

    308KB

  • MD5

    f53e4af30ac4c2a9bd7ecb252cdde389

  • SHA1

    30afe157f74feb4825b43f61a4d0f5d6c8de0440

  • SHA256

    6120d7d092b45f851455f49e8d13e0e2d57f70b3210cf11b4812b94e7b1ec7ae

  • SHA512

    0330d3faadd15ba42e8928ad1555ace0c13ea816fb8215a763a47590cc24cbbb7ba1ef1486106708920de1f9bf6189aa4d2472430dc989bde0639fce31ec8c6a

  • SSDEEP

    6144:4iTCi+B0fL7tQJ5Kp34z6tYc4G7v4G7AWF2:X6B0fdQrKNoL2JA9

Score
6/10
discoverypersistence

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f53e4af30ac4c2a9bd7ecb252cdde389_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f53e4af30ac4c2a9bd7ecb252cdde389_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2668

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads