Analysis
-
max time kernel
149s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
03-10-2024 16:05
General
-
Target
0f864a602248e324f968c20797dc424f_JaffaCakes118.exe
-
Size
125KB
-
MD5
0f864a602248e324f968c20797dc424f
-
SHA1
66e4c9b22a438cba0bd87e992f14949f767ebc9a
-
SHA256
6b200041162cba2502b54124d9c4dbec54b26112e176959ad6c0ac5d63deaff2
-
SHA512
3f77f827cac94a23c5d7045ced40d91fec957be263cbc608fae3297246607465901542c74f418b99eb256c17532d0109fc3171b445a79ec673974e2244ed7a67
-
SSDEEP
3072:EJgwBIxhn+dz7diTqkGqcZBUPs7dHNnu3lAzyDJkluJfBd8s:EuwWx8fScnUPey1BtB
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in Windows directory 4 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f864a602248e324f968c20797dc424f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0f864a602248e324f968c20797dc424f_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Oticea.exeC:\Windows\Oticea.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
125KB
MD50f864a602248e324f968c20797dc424f
SHA166e4c9b22a438cba0bd87e992f14949f767ebc9a
SHA2566b200041162cba2502b54124d9c4dbec54b26112e176959ad6c0ac5d63deaff2
SHA5123f77f827cac94a23c5d7045ced40d91fec957be263cbc608fae3297246607465901542c74f418b99eb256c17532d0109fc3171b445a79ec673974e2244ed7a67
-
Filesize
372B
MD5585d9ac5c66a75e45e19eb29b42cbf65
SHA1f7fe52486d423b08dc02652bcaa92956d593c7cf
SHA256c24c138c6c3b5b428e7c06ba78e9754b61f506f91055ac17011eb13d768e61d4
SHA512d947d325c25a30c5a7e179552cb987e9b63e038b7c1b8924089b3c8d93eb228102021286ccb60417a234ce77469c6c6df6739fbd19549711fc3d1f49f0ed35ab
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
76KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
264KB