Analysis
-
max time kernel
100s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
29-09-2024 12:24
General
-
Target
fe850b9cb64952e4ef425c2483f6e1e5_JaffaCakes118.exe
-
Size
506KB
-
MD5
fe850b9cb64952e4ef425c2483f6e1e5
-
SHA1
859d625c454b1d706d45eff9b710032f4738b3cf
-
SHA256
89aa030be1bc8c352c1e639992143bf0f0b0471344dd24fa4a0c24d46971f996
-
SHA512
5d9e401b244ba9cc8bcdebe40595b5fbba7ea0cd57039209dae0c120b087d9abefb9ea82db06b278e817e845f8f29a8234c5bcd451f734fdffac5901481d5e7f
-
SSDEEP
6144:jaUhMk70XLC1t9N9/W76hVj+VD3hbcd5SVtY/nWMSqKMXGY/uqp:jqkeLCP9NyEma3l4fM
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 6 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe850b9cb64952e4ef425c2483f6e1e5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fe850b9cb64952e4ef425c2483f6e1e5_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Rpikea.exeC:\Windows\Rpikea.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3356 -s 9043⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3356 -ip 33561⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
506KB
MD5fe850b9cb64952e4ef425c2483f6e1e5
SHA1859d625c454b1d706d45eff9b710032f4738b3cf
SHA25689aa030be1bc8c352c1e639992143bf0f0b0471344dd24fa4a0c24d46971f996
SHA5125d9e401b244ba9cc8bcdebe40595b5fbba7ea0cd57039209dae0c120b087d9abefb9ea82db06b278e817e845f8f29a8234c5bcd451f734fdffac5901481d5e7f
-
Filesize
390B
MD5802777cb21d8b3d8759f849c4752ec1f
SHA1034a3550fa81ea7770c9f24f17396315a9f34b74
SHA256b851912b37b50aa696475c02f57eb9a80d15e8ad1854d35d808983d13200cd8f
SHA5121dc04f7caf8ae582c403c7163299291884b383d0a7757abd751eff539b0b065f13781c3d29daa7aa3262cb2e510613bff303a4205b8ec77a7bce6de1fe4f2253
-
Filesize
232KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
232KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
232KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
4KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
232KB
-
Filesize
4KB
-
Filesize
4KB