Analysis
-
max time kernel
150s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
25-09-2024 08:10
General
-
Target
f5914258c41db889e402903ac67ed4f6_JaffaCakes118.exe
-
Size
2.8MB
-
MD5
f5914258c41db889e402903ac67ed4f6
-
SHA1
83e793ac1f9035755fa51bc49a0714343a317156
-
SHA256
4f81092552663aaf57c5c961ca378193dca0ff0e8d6981899a201e26e22e18fd
-
SHA512
6a9b995e337c2d9007c01973e6c90befd25e9df97f4e9374c93d3226536c70b5b4a0819aaf6affa79879bca8aa3b1d2a85d201730b9f51b89959279962677137
-
SSDEEP
49152:EDmsKRJj/P7GP/LqXUTeCLdkt0wbZLHmWUlrvJYW/zPU2+kIqNB:E6sKRF/zGP+XHCLdcb1HNUlL6oPUVS
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Drops file in System32 directory 2 IoCs
-
UPX packed file 10 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SendNotifyMessage 3 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f5914258c41db889e402903ac67ed4f6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f5914258c41db889e402903ac67ed4f6_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\AV Protection 2011v121.exeC:\Windows\system32\AV Protection 2011v121.exe 5985C:\Users\Admin\AppData\Local\Temp\f5914258c41db889e402903ac67ed4f6_JaffaCakes118.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\elIBtzP0yAiDoFa\AV Protection 2011v121.exeC:\Users\Admin\AppData\Roaming\elIBtzP0yAiDoFa\AV Protection 2011v121.exe 5985C:\Windows\SysWOW64\AV Protection 2011v121.exe3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
228B
MD527b4354e7db4fc75f357cd7d7cdf3c6d
SHA16a8f0172da7d8b7937ab0485336fce17b9ba99fc
SHA256cab01e7d2f99648f5cad4850308f64e8768613551c4b8650ab096b6459bc68da
SHA512da86ab1091422383c66b3b86c2f721d8964d0417a503c573dfaa5d008ad3a4ad022afe52020a781c8894be9f849ef089a4c4bee614c35e9e5ab88cbdf5de75cf
-
Filesize
909B
MD5c7bb94b64b877c98da0aa727d67a9aad
SHA1b4104db3130c28ad123f955b65c96bcfe03fb83c
SHA25684f0bd69ef363b89bfed8266f8f5173ea1480344d443b2a0ad429f21498fd51d
SHA512c08bb5158e93003460ed7f73cdcc7d57063260876a91944438d6e28fa5f5b779294cc437204b5aa7303fd6af23e986bf40c51b5eb867b6ef3ae7b7ddb827f467
-
Filesize
1KB
MD5674b68c799b56f4eff7d8981edfefcdb
SHA10e0fb6f94e06083e2bd6f2ceb88bdd4d868ec064
SHA256aaa79c3abc4ca1864fd64036602617880ed53b85ff2002621111e19e23016658
SHA5128ca20e976a514871c22df2e5dbb282ab0c38783a49b279ae5c36da174772f3e470b10e961046e31737a8b4e0f6e7691227ecdb05557e37d9528ea183391b77c7
-
Filesize
2.8MB
MD5f5914258c41db889e402903ac67ed4f6
SHA183e793ac1f9035755fa51bc49a0714343a317156
SHA2564f81092552663aaf57c5c961ca378193dca0ff0e8d6981899a201e26e22e18fd
SHA5126a9b995e337c2d9007c01973e6c90befd25e9df97f4e9374c93d3226536c70b5b4a0819aaf6affa79879bca8aa3b1d2a85d201730b9f51b89959279962677137
-
Filesize
1KB
MD57eab0ddcbf3cec31ec7731b53fdb09d0
SHA1bd75e8a2e47b1153d901874b4ecaff0c1222d149
SHA256a0c9a8935e73279c9a1891afdfa494667cad34cf55063ad912c00ef3706cb280
SHA512aff2f2bfd15f2840e0939b8fd73fea30797394d9fe5d14d02c86df6fe2ee5d28dccdfc3838777b8678c7c8278d3ee286dca219d4344b8782bca52a6dd1e9f4ca
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4KB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB