Analysis
-
max time kernel
93s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
04/10/2024, 23:39
General
-
Target
15559387597230c4981bea1d5b6443f2_JaffaCakes118.exe
-
Size
237KB
-
MD5
15559387597230c4981bea1d5b6443f2
-
SHA1
094a86b7ed7791b1d36e474e99f168f9e8c53329
-
SHA256
a807950a9f22b71b1c95684643ddc3c7cf1996a335af6cffb78ed9e2b5d5f4c0
-
SHA512
43bbd299b882cd8d27cc64ac31447306c9af5cd77454380489c36cd591ba39bd61bc9c1ef54b09b19d562b7be3cb1b8f4da73947106382b130b928d1d9d05afa
-
SSDEEP
6144:pY8vvEA36yTHZHRmksKprK4FLeeM6Mhh6lKMEKQ8IRL:pYFeBTHGEr7FLeeM6aME7
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 6 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 62 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\15559387597230c4981bea1d5b6443f2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\15559387597230c4981bea1d5b6443f2_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Psudea.exeC:\Windows\Psudea.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4532 -s 9123⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4532 -ip 45321⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
237KB
MD515559387597230c4981bea1d5b6443f2
SHA1094a86b7ed7791b1d36e474e99f168f9e8c53329
SHA256a807950a9f22b71b1c95684643ddc3c7cf1996a335af6cffb78ed9e2b5d5f4c0
SHA51243bbd299b882cd8d27cc64ac31447306c9af5cd77454380489c36cd591ba39bd61bc9c1ef54b09b19d562b7be3cb1b8f4da73947106382b130b928d1d9d05afa
-
Filesize
390B
MD5eff53ff4874e298b0331d7fe8367ebf9
SHA1a014cdb85d1bc8062ceccc1ca3e1fc67d0000784
SHA256425e7c7ec77360cb0c901494cecac1f24660c7a1b4d7dc68dc002261ed33c2aa
SHA51284d5112bc72cf6d0c975545860a0b69a3aa07efd65cd31f3971c46b57cf9d092486b9262af656c87499129e2e79661ee959e8357751db763079657997a01fb16
-
Filesize
4KB
-
Filesize
504KB
-
Filesize
504KB
-
Filesize
240KB
-
Filesize
4KB
-
Filesize
504KB
-
Filesize
504KB
-
Filesize
240KB
-
Filesize
504KB
-
Filesize
240KB
-
Filesize
504KB
-
Filesize
504KB
-
Filesize
240KB