Analysis
-
max time kernel
149s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
30/09/2024, 21:17
General
-
Target
0349ca4db3a1bf9aba3c2ce61d7a9b99_JaffaCakes118.exe
-
Size
985KB
-
MD5
0349ca4db3a1bf9aba3c2ce61d7a9b99
-
SHA1
be4728d61149b6697d93955558851a673c0969d6
-
SHA256
ca1bcef0bfc476f240daa7d46a45f88bbdc2282ca7e50edf8eaa18e2cbfec1ef
-
SHA512
0f5ae7049f1529b80688ed7eb6595a8a156ceecf7939c4add746e7979ca29a2faef94d387ce83a7c3f2d5d151dcb4ce442b466e5bbe3522966dd683b10d96d4f
-
SSDEEP
24576:4w6TLqE6IzA5CIZ7TGHaqPIesbQv8NDjQxUvWXSuyZ:QeEy32B035k32
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 4 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of FindShellTrayWindow 10 IoCs
-
Suspicious use of SendNotifyMessage 10 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0349ca4db3a1bf9aba3c2ce61d7a9b99_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0349ca4db3a1bf9aba3c2ce61d7a9b99_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\56334.bat" "2⤵
- Deletes itself
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg delete HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v 0349ca4db3a1bf9aba3c2ce61d7a9b99_JaffaCakes118 /f3⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Users\Admin\AppData\Local\8017032128.exeC:\Users\Admin\AppData\Local\801703~1.EXE -i3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
437B
MD5a7975d20ca7a470f0eb7ddc4582cb48a
SHA13b553404b4fdebee37719910468578a2f2470b0b
SHA2563285f5c16e369a24ff4c20e564df14251754e361d1cbbd339c437d244010a29f
SHA512dfa7bf5f17cb71a0b02181e6d2f41e0d29322977774f301cfdf7787d6baa1f22d5db6354d9ff99ba6cb9b192bf0d442f9f9d948234e95537a1bdd8f095fabb8a
-
Filesize
985KB
MD50349ca4db3a1bf9aba3c2ce61d7a9b99
SHA1be4728d61149b6697d93955558851a673c0969d6
SHA256ca1bcef0bfc476f240daa7d46a45f88bbdc2282ca7e50edf8eaa18e2cbfec1ef
SHA5120f5ae7049f1529b80688ed7eb6595a8a156ceecf7939c4add746e7979ca29a2faef94d387ce83a7c3f2d5d151dcb4ce442b466e5bbe3522966dd683b10d96d4f
-
Filesize
4.2MB
-
Filesize
4.2MB
-
Filesize
4.2MB
-
Filesize
4.2MB
-
Filesize
4.2MB
-
Filesize
4.2MB
-
Filesize
4.2MB
-
Filesize
4.2MB
-
Filesize
4.2MB
-
Filesize
4.2MB
-
Filesize
4.2MB
-
Filesize
4.2MB
-
Filesize
4.2MB
-
Filesize
4.2MB
-
Filesize
4.2MB
-
Filesize
4.2MB
-
Filesize
4.2MB
-
Filesize
4.2MB