Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
29/09/2024, 23:46
General
-
Target
ff8576ae88dcaa9dd3d66f8490e49fe5_JaffaCakes118.exe
-
Size
399KB
-
MD5
ff8576ae88dcaa9dd3d66f8490e49fe5
-
SHA1
a839a0016f7bf42f1c9227d3e6fcc489092bffe2
-
SHA256
5d66f7c7c0b0c3dcddba9dd01ee553bd177e5a5d4f27960322603b044973d3c7
-
SHA512
95ee0fb6c4ab7a13fb420cc20acdd485c2ee1b0d3929fc9d4a41f45a5bc8341e03d9378bc3ef00a665595f074621a20f17f0ec14fe3560e9d5f678f0dd2e8c5a
-
SSDEEP
6144:fbWbsX6j9UVsRNmq41V7FqSexNV8+hCGTr1e1Kxx9zxggB:6t9UVW4q4f7F67V8+hPcKxx9zfB
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
UPX packed file 9 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff8576ae88dcaa9dd3d66f8490e49fe5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ff8576ae88dcaa9dd3d66f8490e49fe5_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\bL01300FcHoH01300\bL01300FcHoH01300.exe"C:\ProgramData\bL01300FcHoH01300\bL01300FcHoH01300.exe" "C:\Users\Admin\AppData\Local\Temp\ff8576ae88dcaa9dd3d66f8490e49fe5_JaffaCakes118.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
208B
MD53d2cd75e07a333490d8372cfb9a59df9
SHA132e47a35fc08fe5e2474a9cde42576f99136b012
SHA25632213303a29106db24a05f833c79e2cbdf2466844f86dc00937ec590a83c72bf
SHA512081effc477d7de4f5827a42c1d0d7af169c76bdae0cca0b89a844aa7e8a93dd37299f1ca9504d9cd8727982e6bf882924190bcdf93b15001a23f8c3edf861b45
-
Filesize
399KB
MD59b46f3661b62dbe08564f51c268baea9
SHA142ef74bce276e870468dc861edfe8abc0fcfab5a
SHA2562934ca2271118587a012f57744ff57337f76d5f948baee796222a80b43873b26
SHA512ad4922c954f59ef621c27c6775507af7021a71cb3cd47e09d784a1745676e57d52e2a25e3310ca7f6d16c63647b3cf495993734050f050b953dec1c414680754
-
Filesize
832KB
-
Filesize
832KB
-
Filesize
832KB
-
Filesize
832KB
-
Filesize
832KB
-
Filesize
4KB
-
Filesize
832KB
-
Filesize
832KB
-
Filesize
832KB
-
Filesize
832KB
-
Filesize
12KB
-
Filesize
832KB