Analysis
-
max time kernel
95s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
04/10/2024, 11:34
General
-
Target
132feadce0b31aa930c607478e3922a1_JaffaCakes118.exe
-
Size
8KB
-
MD5
132feadce0b31aa930c607478e3922a1
-
SHA1
b0b11f5f71b4ddc1f9aab33f07edc0a10bfd0cc9
-
SHA256
c5e9b4336c6e023c45a5e17dc0d3f92c74dc0ff06ded18be44efe80b20a71616
-
SHA512
aa79a9ddcd2219cbef366a0bea9e10b71ab8c331050f1d1d75baf39da738647c7a2229ab5c6c6cf922a4680dd98955352e1b4cbc49e5977ca7bbba6c1533e429
-
SSDEEP
192:q4PwzaLI3H6k3niwBufEn+7DetH+Z+vsYJRI9szkrap:jQ6w3ninMn+7IH+ZWfQY
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\132feadce0b31aa930c607478e3922a1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\132feadce0b31aa930c607478e3922a1_JaffaCakes118.exe"2⤵
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\132feadce0b31aa930c607478e3922a1_JaffaCakes118.exe"3⤵
- System Location Discovery: System Language Discovery
-
-