Analysis
-
max time kernel
145s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
29/09/2024, 14:31
General
-
Target
feb99b74ebd5d413ee238de3478a9bd6_JaffaCakes118.exe
-
Size
87KB
-
MD5
feb99b74ebd5d413ee238de3478a9bd6
-
SHA1
7c8886fb640a3578bcd15040526a11436478ff8f
-
SHA256
7f859a42db4bf2767c59b7ac74f4b529834d7e6d7fdba8796618e1b7281e5e63
-
SHA512
65f0fa0bd03c3318dc8c9a047ebc24fd8fcc0d36054aa797fcfe42e707e2691350d498075c1a5940c4eaae3dfcb1e1c66997c07944ae143973e9054f148804c1
-
SSDEEP
1536:gMqbjyuQSgMgDxTi2ZfzAoswexmVEYjUd+YbWsEe2zVc89BvBjgNSc:9qGuQSgfl5b+Ojc+YWsEe2zVc89lB8NV
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 10 IoCs
-
Suspicious use of FindShellTrayWindow 58 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\feb99b74ebd5d413ee238de3478a9bd6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\feb99b74ebd5d413ee238de3478a9bd6_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Slave.exeC:\Windows\Slave.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
87KB
MD5feb99b74ebd5d413ee238de3478a9bd6
SHA17c8886fb640a3578bcd15040526a11436478ff8f
SHA2567f859a42db4bf2767c59b7ac74f4b529834d7e6d7fdba8796618e1b7281e5e63
SHA51265f0fa0bd03c3318dc8c9a047ebc24fd8fcc0d36054aa797fcfe42e707e2691350d498075c1a5940c4eaae3dfcb1e1c66997c07944ae143973e9054f148804c1
-
Filesize
563B
MD54189c426759265139dbb8e6f8e2b20f4
SHA1c5c7245e63affd191047c732a4dd12f8facbcea4
SHA2569f8531abccbf26599bc9ce2e1af640058c36894a976611c8535a1bceeb80b819
SHA51207f08a4b0dffc1632e9f29fd44ce911036c53f3e6c4b123ccde2f6976e99a22357f2352a69a65f5f353f741fa0a2ecbaafb2d5a5e587a3ae2cec37b4d8c01153
-
Filesize
336KB
-
Filesize
336KB
-
Filesize
336KB
-
Filesize
336KB
-
Filesize
336KB
-
Filesize
336KB
-
Filesize
336KB