Analysis
-
max time kernel
142s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
01/10/2024, 02:40
General
-
Target
0413a4bb8e532da06d001a3cd660675f_JaffaCakes118.exe
-
Size
806KB
-
MD5
0413a4bb8e532da06d001a3cd660675f
-
SHA1
c9c624619788cf0f2944a003770b8c8d18757e6a
-
SHA256
6a94716648b6b9de0d42af03628d0578500bd1cdf063ce4ae55db5b0b92bc89a
-
SHA512
110e60fdcf9537dfbe04e9d73fbbfadb28f2824a50bc5e76e9879fa663830e3629c0633becb9f34ea74e0f39ca2bac8e94b13e6f8735d00c4f1da5f8bd18d875
-
SSDEEP
12288:BGBrhBXzUNXocDtm+IAvFno+kO9HOdhaxNJnLb6YE9e+jQLcJ:UBHzUnY+/F1kOZkha/ZyYE46nJ
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 4 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0413a4bb8e532da06d001a3cd660675f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0413a4bb8e532da06d001a3cd660675f_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\wdfmgrs.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\wdfmgrs.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Patch.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Patch.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\wdfmgrs.exeC:\Windows\SysWOW64\wdfmgrs.exe -service1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x424 0x33c1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
322KB
MD57cc287473498bc328dc272f2d12db44a
SHA1830ba3d81893027ec5ab146c98cc4a6686be70e3
SHA2566df8010fd70d2ced8bedb3d7130652675c376534f806e1c8ea564419e3b86215
SHA51209a45475265726212aa7747ffc1b5ab4cc5cf9725b54938391316bf94f1f0a797eb9105ab81e12f26a312f4241de4c0150a608570b11de2857a1d46e5804f9d2
-
Filesize
517KB
MD5d1254edca9a72083e11a94feefafe8df
SHA14c22e786134c8339f423c2fa09bffccdf8868b01
SHA2566a8f36d163a4fc4022579c32e24a28c170ae499e8661ea03e1300f98101c6584
SHA5126deee1aec34992b19b5fcc6df6f38a9c789293c350180d5baf1bb2f0cf01885ae71942bbf53d22a458481ed30b395b5e2d62f1a5c02e0bcde667cb89ff6548c3
-
Filesize
33KB
MD5e4ec57e8508c5c4040383ebe6d367928
SHA1b22bcce36d9fdeae8ab7a7ecc0b01c8176648d06
SHA2568ad9e47693e292f381da42ddc13724a3063040e51c26f4ca8e1f8e2f1ddd547f
SHA51277d5cf66caf06e192e668fae2b2594e60a498e8e0ccef5b09b9710721a4cdb0c852d00c446fd32c5b5c85e739de2e73cb1f1f6044879fe7d237341bbb6f27822
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
4KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
336KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
336KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB