Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
28-09-2024 08:52
General
-
Target
fbef48315232d1b8da0e97bf13d44ae1_JaffaCakes118.exe
-
Size
473KB
-
MD5
fbef48315232d1b8da0e97bf13d44ae1
-
SHA1
801c314d2008d7e1604c00c7215c68e54c6d1040
-
SHA256
f92fdf2f4b0e767251e2d940b640365b70e8b117ceafb37280d8af18b0a73065
-
SHA512
64d91c2ee7e91277054a1344a57e0ef140b116e857694013e18c2be9cfa21ad72f7fe58853b689c8f07b2f79c2d54235d291902fdbdd282d8adc6be35da12461
-
SSDEEP
12288:yEs/k5VZI19Una4PNZDRCK78woIvh0Nj9YEsM2ZQm150dboS:yEssXWYa4PXDp78XIqN2RMwJu
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
UPX packed file 11 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fbef48315232d1b8da0e97bf13d44ae1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fbef48315232d1b8da0e97bf13d44ae1_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\jO28621ApCmP28621\jO28621ApCmP28621.exe"C:\ProgramData\jO28621ApCmP28621\jO28621ApCmP28621.exe" "C:\Users\Admin\AppData\Local\Temp\fbef48315232d1b8da0e97bf13d44ae1_JaffaCakes118.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192B
MD5945277fefab0b887f418f8908137bf1d
SHA193e603a6d8f624b953de0cae5ce7cf17e4496d46
SHA2561a956cbcea8ee2cbbeaf106976e84633cfe7e5459f09b23c1967c2a154872180
SHA512b134d68882289ed952d37b55ea07f3eb33eaaabfc8b7f6477a4a3e6a73e53e08bd6d2df09cef1f324941b649bb169550558138fcb95f45a29a05ee6462bcdad6
-
Filesize
473KB
MD5ce392f6635c971710361cf10c0100084
SHA11f139a60df25c8f861362473b01cce8bf0aa2598
SHA256f4d97fe6697f4e712c632ccdbd285c79bf8a0645c6bcc89d8ec825c51a0eb480
SHA512f395304ad92e2ff5751cfb4e6f8a0b6dfdc70bd6e3bd8589964d4275596bca766217c1b05395690d9f692271d01cae94321f44ef89468cb9f46ebca8817be088
-
Filesize
764KB
-
Filesize
816KB
-
Filesize
660KB
-
Filesize
816KB
-
Filesize
764KB
-
Filesize
332KB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
816KB