Analysis
-
max time kernel
133s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
01/10/2024, 22:25
General
-
Target
07ab8a90178c230af795eb3700c4a95c_JaffaCakes118.exe
-
Size
52KB
-
MD5
07ab8a90178c230af795eb3700c4a95c
-
SHA1
245d021be7a463ab463dc3b0999fb40602611ceb
-
SHA256
6730f905d23498aa7360b4d91a8b500b48015f8883800b25ade213534fda9bd4
-
SHA512
44f36ff7b48fd13bce5af5bf09cbb2a961e669987d19eeb1306bd3efe1cb6790be80b05c6af040e449d998f7ad1007b89ab030588a2b13e173b96f659caca7ab
-
SSDEEP
1536:a/BaV7B17CJ/I7vOhK2KNS8BifhDTLKkEzZ:Nv7s/IzUKctfhDf8Z
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Loads dropped DLL 5 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 37 IoCs
-
Suspicious use of FindShellTrayWindow 29 IoCs
-
Suspicious use of SendNotifyMessage 22 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\07ab8a90178c230af795eb3700c4a95c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\07ab8a90178c230af795eb3700c4a95c_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5eb4f9bd8532ec3859841cd3a9d4c7fa6
SHA1161a37afaa840ca4fe8d6a7ab2d30d87d4466199
SHA2563ea8fc57ca83c0bcbe87f55916501540953e4b26e105a402eeb25c85d57499f7
SHA512604c93b629465c86c1a00ec6e417369b9699aecfe1c9221d3f678b7910787a186fcf0593e2d0d13e05b013ea41f10bddfc0d2d461431b228fc7ed042fb2f890f
-
Filesize
1KB
MD5026203629c68171c30fb7e193403cc9e
SHA171a208b7238319b5b352e23cc45f823eebed51cb
SHA256fe3c359d20f9d2c06a950dd7eb14565be9be2ad35b01444eac2c7e393fb9f648
SHA5120a00e314ee36fe92578a24225d49b98f9712dba0bb117ed9a9e5d9bd48a2c0e73e8ef5947906fe8bd8889cee490cead1da47e90eea634f2dd0c14d55a44a481c
-
Filesize
1KB
MD541dce76b03d3f718d2a9df83c6c6de96
SHA1617480872c6180ce2ecb7184d4627b2be3266573
SHA256a5308029175c99d0318f2f7de889e8801d1c70cd6a8e8c892bdea1c950930321
SHA5120005edddc90bc5cc97ae53a8cb0ccce840c1c590fe40448858a9956656e7fae805dbd35054882daa45bddadc55f0a169ec0386c004d5a187646f51bbac895058
-
Filesize
18KB
MD575841f234d770b70f4bfdf69c6e545c8
SHA12f1c96faa3ecf8288c36ffbc4e3605806c6bef74
SHA2562a38c06f76019cc1a411c2c84e06864942e3c2ff04e2daed50cbe509edabe36f
SHA5121314544ace13fe728ca9a2b247eb0bf157edbd624efe2de534d5ae0783535720e186364c805882fa5d0a2720b9aee06652f65dd1b4bb6bb846951346b1b3fa62
-
Filesize
128KB
-
Filesize
20KB
-
Filesize
128KB
-
Filesize
64KB