Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
28/09/2024, 14:56
General
-
Target
fc89b275f7fd924439cc4be7a0340fc6_JaffaCakes118.exe
-
Size
399KB
-
MD5
fc89b275f7fd924439cc4be7a0340fc6
-
SHA1
00213497e8166c80463184c5b755f42799f7e5cd
-
SHA256
c416b7fc4c158974c90ab1b735e880fdb1d32a5f41650489c0e239becc1331db
-
SHA512
2dc10d5e88f9b615d793176de94c03cb92b9cb2051887fcfe0f73acc41b6d0124a925010b2729f6dc7f2f56244c392423f80798b41ac1b0da5d2673e9afed89d
-
SSDEEP
6144:SbWbsX6j9UVsRNmq41V7FqSexNV8+hCGTr1e1Kxx9zxggB:vt9UVW4q4f7F67V8+hPcKxx9zfB
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
UPX packed file 9 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fc89b275f7fd924439cc4be7a0340fc6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fc89b275f7fd924439cc4be7a0340fc6_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\nA02401ObJjN02401\nA02401ObJjN02401.exe"C:\ProgramData\nA02401ObJjN02401\nA02401ObJjN02401.exe" "C:\Users\Admin\AppData\Local\Temp\fc89b275f7fd924439cc4be7a0340fc6_JaffaCakes118.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
208B
MD5682988f61f10c39f8af1ff38cbf6e916
SHA16455e703c49304c33bfd600c95b1ab309516747c
SHA25636cb7e800dddf720aa222a0f43ab4055beab1e854d51251eab464505e9931c79
SHA51294535321a3dec5acbf7a938c46ba29fda9273c729a29757d599a353da8415ae25f038548351dc1bdb488a2b2ea88e1f3786cdfc25a0937c83d35e8fbf11d667e
-
Filesize
399KB
MD5a38d6750a3ccb2d4f6bc212280c7ce0a
SHA136a7f76f8f6bc796bc7f55c9bb49c76892afbc62
SHA256acbca6f76bc3383a19108171de020e75d8b2a1daba22bf5671e26c9fa2d67852
SHA512c21a0750b90c5c1df2fbd5658592aa5fad1dd7c5de08bd5c4f7627c8de263734171f48a5b220e310799509d121e04465eb26462003e12cabafc5b3a0d9265155
-
Filesize
4KB
-
Filesize
12KB
-
Filesize
832KB
-
Filesize
832KB
-
Filesize
832KB
-
Filesize
832KB
-
Filesize
832KB
-
Filesize
832KB
-
Filesize
832KB
-
Filesize
832KB
-
Filesize
832KB
-
Filesize
832KB