Analysis
-
max time kernel
84s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
02-10-2024 11:06
General
-
Target
0a5916725f414419e336fe94ee5b1ad0_JaffaCakes118.exe
-
Size
216KB
-
MD5
0a5916725f414419e336fe94ee5b1ad0
-
SHA1
ab577884912c883de6e2c57bbf3d3294e94dc14b
-
SHA256
c24d11f906a51c9fede93a33301700123b9e1f8ea3d689cc2be4ded2fa906912
-
SHA512
b6f591fe404b517bb504deee4f76c45ca82566567c0464b21e373e83398968136385ed8574c7824daa75b43ced352ecf29ef9c1d884cdd31c8a1ff7130ae04ba
-
SSDEEP
6144:oGhnZMehCpGL0k83nzKmdJnSdSiOBSbGq:BMehCpGARneKJnWeS
Malware Config
Signatures
-
Modifies security service 2 TTPs 4 IoCs
-
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE 2 IoCs
-
Unexpected DNS network traffic destination 9 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Suspicious use of SetThreadContext 3 IoCs
-
Drops file in Program Files directory 18 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 6 IoCs
-
NTFS ADS 18 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 7 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\0a5916725f414419e336fe94ee5b1ad0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0a5916725f414419e336fe94ee5b1ad0_JaffaCakes118.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0a5916725f414419e336fe94ee5b1ad0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0a5916725f414419e336fe94ee5b1ad0_JaffaCakes118.exe"3⤵
- Modifies security service
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5feb1e198094d763e6b201aadd7d031bf
SHA1a3a96c2345fd3d5c5fceca44242fa6b86b73cad8
SHA256048512cf469905ccc6bff1695fa3d944c3e7acd977cddd103fd110d1a9396f06
SHA51277d6a7870d57a70883f3fd7953bfdd8b4c69eff639263e2adc57d4d1e4287c578fd4d2220b7c838ddd98a7d4383b80c74977df5f7bca7f002b3645aaf246b3a6
-
Filesize
25KB
MD59e0cd37b6d0809cf7d5fa5b521538d0d
SHA1411ffdbe6c151dbd417bc59fa9dfec22b0adc9f2
SHA25655d9748f0556576a8d522cf4b8dcfc9717436adcc487d49b3320770432960db2
SHA512b511ee744dbe6cf0f54cb840d3786e89161115d0038425dde86d57752f76cae7a05f020120b43dc1444bd914c8c1690049e456635cc794fbf90e26794587dfc5
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
172KB
-
Filesize
172KB
-
Filesize
172KB
-
Filesize
172KB
-
Filesize
172KB
-
Filesize
120KB
-
Filesize
120KB
-
Filesize
120KB
-
Filesize
120KB
-
Filesize
236KB
-
Filesize
172KB
-
Filesize
120KB