Analysis
-
max time kernel
150s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
27-09-2024 14:29
General
-
Target
fa9340d04d68a8c0fff1b54a59272b54_JaffaCakes118.exe
-
Size
416KB
-
MD5
fa9340d04d68a8c0fff1b54a59272b54
-
SHA1
ad385317e767c7c261faa42cc16e8411922c9a19
-
SHA256
03b91c6186d81581f8bf13aaceccbc1297593f803f6e72a2164ebbf4d307e257
-
SHA512
c2fe6958c0bf7a9ae0ebc6e79aa9ebca49f8e94c29eba93f1cfd45c26afeab8caa9dd50fc87e569dd2aeb349ad419f8fee1eb70ef4ad0ba2ddffe253d72a133a
-
SSDEEP
12288:JZ6TIoft2yugll2jnAaeX6mXM3W4/Plf:JZ6glQlCn0X6X3WoNf
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
UPX packed file 9 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fa9340d04d68a8c0fff1b54a59272b54_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fa9340d04d68a8c0fff1b54a59272b54_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\ePaMkAd08400\ePaMkAd08400.exe"C:\ProgramData\ePaMkAd08400\ePaMkAd08400.exe" "C:\Users\Admin\AppData\Local\Temp\fa9340d04d68a8c0fff1b54a59272b54_JaffaCakes118.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
416KB
MD54c55696ac71ff230b1c3bdf0f3a55ec8
SHA1121e26dd7e0448e52d45c95a6077b604e924746c
SHA25644ac5214105f9571549e75586fee3ffb32051dff6a4ec4fe372d96c0f8eada99
SHA5127f329426087294fdeb37acd9637712fbd30ec6450308095265593c1dfac87e0f09ac6e70198d2a9a9e83d49ef51eb4b9b5b4c217d49f4010d07052cd63297b14
-
Filesize
716KB
-
Filesize
716KB
-
Filesize
4KB
-
Filesize
716KB
-
Filesize
716KB
-
Filesize
716KB
-
Filesize
4KB
-
Filesize
716KB
-
Filesize
716KB
-
Filesize
716KB
-
Filesize
716KB
-
Filesize
716KB