Analysis
-
max time kernel
141s -
max time network
116s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
03-10-2024 15:54
General
-
Target
0f7a03ff397a95e57cefbdbf8954ea30_JaffaCakes118.exe
-
Size
494KB
-
MD5
0f7a03ff397a95e57cefbdbf8954ea30
-
SHA1
c2bae51fbe3c435cdf66cc55c7829ed76a3b85e5
-
SHA256
1eea1e550d3f9ef97d42286fef537f3b29a93aa95e8cb859fb793383bcbd731d
-
SHA512
0a763fe989750731fe703d23f5983e4a85344483f36786b2e678402ef6238b541837fb14681890a1ce69392923eef3916ef9cc9513488bce155a5fb7ad7dad45
-
SSDEEP
12288:aGSB9TpivQmcKIpbSR/J7zMhv8NtTirdorX6:aF9wImcKI8R/J7zMB8TEdoG
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f7a03ff397a95e57cefbdbf8954ea30_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0f7a03ff397a95e57cefbdbf8954ea30_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\GUOCYOKl.BAT2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\askldjkl.exeC:\Windows\askldjkl.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
218B
MD59eabb865e2e0d58f8dc928c9058876bf
SHA1cb5b4eae725f69e4457831242e4355cdb1ed6467
SHA25607fce69cb8d1cd89e8494bf010d1f380e44c29b76fcd15db1afeb471e4ce41c3
SHA51206244d02a785cdf36909d52201c9212445f4188f00e642c320d676c566fd8f2b97c5e5d126fb07753dcb261c1e38c0c66dcadbf9c476ed544ebaaa9246f1a611
-
Filesize
494KB
MD50f7a03ff397a95e57cefbdbf8954ea30
SHA1c2bae51fbe3c435cdf66cc55c7829ed76a3b85e5
SHA2561eea1e550d3f9ef97d42286fef537f3b29a93aa95e8cb859fb793383bcbd731d
SHA5120a763fe989750731fe703d23f5983e4a85344483f36786b2e678402ef6238b541837fb14681890a1ce69392923eef3916ef9cc9513488bce155a5fb7ad7dad45
-
Filesize
976KB
-
Filesize
268KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
12KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
268KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
976KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
976KB
-
Filesize
268KB
-
Filesize
268KB
-
Filesize
976KB
-
Filesize
268KB
-
Filesize
976KB
-
Filesize
976KB