Analysis
-
max time kernel
145s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
29-09-2024 14:31
General
-
Target
feb99b74ebd5d413ee238de3478a9bd6_JaffaCakes118.exe
-
Size
87KB
-
MD5
feb99b74ebd5d413ee238de3478a9bd6
-
SHA1
7c8886fb640a3578bcd15040526a11436478ff8f
-
SHA256
7f859a42db4bf2767c59b7ac74f4b529834d7e6d7fdba8796618e1b7281e5e63
-
SHA512
65f0fa0bd03c3318dc8c9a047ebc24fd8fcc0d36054aa797fcfe42e707e2691350d498075c1a5940c4eaae3dfcb1e1c66997c07944ae143973e9054f148804c1
-
SSDEEP
1536:gMqbjyuQSgMgDxTi2ZfzAoswexmVEYjUd+YbWsEe2zVc89BvBjgNSc:9qGuQSgfl5b+Ojc+YWsEe2zVc89lB8NV
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 10 IoCs
-
Suspicious use of FindShellTrayWindow 58 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\feb99b74ebd5d413ee238de3478a9bd6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\feb99b74ebd5d413ee238de3478a9bd6_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Slave.exeC:\Windows\Slave.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
87KB
MD5feb99b74ebd5d413ee238de3478a9bd6
SHA17c8886fb640a3578bcd15040526a11436478ff8f
SHA2567f859a42db4bf2767c59b7ac74f4b529834d7e6d7fdba8796618e1b7281e5e63
SHA51265f0fa0bd03c3318dc8c9a047ebc24fd8fcc0d36054aa797fcfe42e707e2691350d498075c1a5940c4eaae3dfcb1e1c66997c07944ae143973e9054f148804c1
-
Filesize
385B
MD5e4026159d14dad17a91b58a25fb71ff5
SHA1011494819c6c6b6a421faeea75d29d04434d7a60
SHA256401b1927ca02f62d63f271e4ae786e68eee4555ba2781c289b6ac4544c0f55c9
SHA512f250d8c1746b65919330bf0a7ed8797a89486f12e14283a7b5c029b36a6c41a462ef6c9aeb97fd62344aa3c0f38be63ba29ecf78b778d235f57fd02ea24c21cd
-
Filesize
336KB
-
Filesize
336KB
-
Filesize
336KB
-
Filesize
336KB
-
Filesize
336KB
-
Filesize
336KB
-
Filesize
336KB
-
Filesize
336KB