Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
09/10/2024, 00:59
General
-
Target
281a99c0f1de869dcc46ced2570ad220_JaffaCakes118.exe
-
Size
449KB
-
MD5
281a99c0f1de869dcc46ced2570ad220
-
SHA1
4e753a427fdb618503556cfcd826c2a429cb15b0
-
SHA256
6ddc35fcb8253fc0ac9e912e794766a0e4d7b6f496d54646543910a3a6f971e4
-
SHA512
2044b92087b6d0216f6486adba3c1a5e17d9689f382933900f7bcf84da1bcccbf60c57824874474a256d97778d99bc349409cc544f91e73f4af8cbb6673501bd
-
SSDEEP
6144:SVTZuevI0NN8mEI0z74Y8b9Gb4Cuo8fFIUns0HCpD/hPJJWjt+tXuS+q5U:m1Pv04Ywi4ZopYdipFBJYv0U
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\281a99c0f1de869dcc46ced2570ad220_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\281a99c0f1de869dcc46ced2570ad220_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\fD11444PmKnE11444\fD11444PmKnE11444.exe"C:\ProgramData\fD11444PmKnE11444\fD11444PmKnE11444.exe" "C:\Users\Admin\AppData\Local\Temp\281a99c0f1de869dcc46ced2570ad220_JaffaCakes118.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192B
MD57893931f0dbc882cd5fbd2a1b71b973d
SHA13d491b6bc2eaead0386cd270636acd6c3e30c669
SHA256225e833837a74187b02084e413ed498163a35953ab8c3dcd7f9d84fa1ff3bcf3
SHA512646c1fb5fad7e1cb4681c799e7c5fd310d5116d35b50872938e2c8f924364e2cfd2dd460078b1c8017dfb958e98ef2e4008b6688d8f6d46ef57dba85d736716e
-
Filesize
449KB
MD5ddfe626e48137f14f4dd636f131ebf68
SHA1b8a3019e77787a34ea7962f70818ecf63125b19f
SHA256144e93c450cbb286aa28c71307456a93f0e00d937c7b261e46836b365956a2ed
SHA512bac31f500858d4067cc28f0348e6a6d89a4dc01475c496ae2f94f71e358a757d76968bd41cc4f2ed966516aed9ca7d5ad40bad6f06636153142f27be9329b844
-
Filesize
4KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB