Analysis
-
max time kernel
150s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
04/10/2024, 03:28
General
-
Target
11a60d6dc225e66dd5ea8157280599f8_JaffaCakes118.exe
-
Size
129KB
-
MD5
11a60d6dc225e66dd5ea8157280599f8
-
SHA1
ce5e66fe81233010fa74c4fb7f03e3c0e63869b8
-
SHA256
c5b34f78fcc6cb0f0babd056edb446faf6e85df4f4d89cd2c200d29abb262217
-
SHA512
0f9768c8f54bc6d30e9e88c7592320f1b44317b86e3f78a94b09ea2bcfba5b12e28959a4b125dc8fb89170b4d4db4927ca0b8c07137796056fbc229f2f0d635f
-
SSDEEP
3072:khVNVsd+BBGpoAbHCiJDCUdcPt0RiIoGxz2BCiY8qvecdNY:4NuMOCiUUdcPCMVG52BLgd
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in Windows directory 4 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\11a60d6dc225e66dd5ea8157280599f8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11a60d6dc225e66dd5ea8157280599f8_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Windows\Xwynia.exeC:\Windows\Xwynia.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2B
MD5309fc7d3bc53bb63ac42e359260ac740
SHA12064f80f811db79a33c4e51c10221454e30c74ae
SHA256ac11339ffa8f270c4f781e0a3922bb1c80d9dee6e4b6911ca34538ed9ae03caa
SHA51277dd27d30f4e13a0bcd6fd27ae7567c136d87393e5ee632bccf05b0a0d2bbcc2fc0fd777a8508e26cc4fc579c8da0ab56b7bf179b1adc70f28f7d0eee89fa5f8
-
Filesize
372B
MD578ecd4292eebb7a9426d5f0a678bb572
SHA18bd4e98d18700aa999481fd54ff0c132e94ff937
SHA256a28182d02910be3afa5f2dd0233955ccaa9471c3206fc0097a132a39dd3a14f9
SHA512131894b889d8a68c3548c686389d489427b9dedd96c617e8fe976e1d6096b2f2c642894e033d52be4f2a1b1833a62a31cd151e35a99a8d780ac5a6ef3da12d2e
-
Filesize
129KB
MD511a60d6dc225e66dd5ea8157280599f8
SHA1ce5e66fe81233010fa74c4fb7f03e3c0e63869b8
SHA256c5b34f78fcc6cb0f0babd056edb446faf6e85df4f4d89cd2c200d29abb262217
SHA5120f9768c8f54bc6d30e9e88c7592320f1b44317b86e3f78a94b09ea2bcfba5b12e28959a4b125dc8fb89170b4d4db4927ca0b8c07137796056fbc229f2f0d635f
-
Filesize
136KB
-
Filesize
240KB
-
Filesize
60KB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
60KB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
60KB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
60KB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
240KB