Analysis
-
max time kernel
144s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
09/10/2024, 03:03
General
-
Target
29aa9c4be6616e48f041f9f81dedb75e_JaffaCakes118.exe
-
Size
672KB
-
MD5
29aa9c4be6616e48f041f9f81dedb75e
-
SHA1
4aa2643ae02f690c9b6220f422927d0956a4914c
-
SHA256
0176bb4179cbc06415449611666ee9035bcc564a554d449f5404363a05bfdfbb
-
SHA512
e911d3652e8e4dc55ecd625e8f589833d5a2f51b91f90374ce96dd4caf9ff76f6c2b3cdaab7896d9fa213f9d4d440505c1d292c5c1f2e163423026e822e2148a
-
SSDEEP
12288:8kQ4PIcBqHybSce3dhPq5nd+qsT1Z7LrA2rItSaItS/:85QIzHyuhiDyrProSaoS/
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 8 IoCs
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
UPX packed file 24 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\29aa9c4be6616e48f041f9f81dedb75e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\29aa9c4be6616e48f041f9f81dedb75e_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\¼¦¸ç¸ßÊÖ¼üλ±ä»»(ÐÂÊÖÎóÓÃ).exe"C:\Users\Admin\AppData\Local\Temp\¼¦¸ç¸ßÊÖ¼üλ±ä»»(ÐÂÊÖÎóÓÃ).exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\ÐÂ!¸ßÊÖ¼üλ±ä»».exe"C:\Users\Admin\AppData\Local\Temp\ÐÂ!¸ßÊÖ¼üλ±ä»».exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
52KB
MD5069fa268827d3ee36d680a606c5a7da3
SHA1d63c6761615d64ac6c0d5f7368716ae22cbf8024
SHA2563d3bd4691ae6596d7e5eb46857417cf70a74a07a3cc10583eccadeb4cd3595fd
SHA5124dea24f3d2d4692fab4714991a70fb37f5bcab80578ceeff107b9a1b4646c22465be099144576980acde529840f13dec6c09f1d2c65c36c7ada6fd6ec67a060d
-
Filesize
53KB
MD57577313a4d641886e0ad54ebbcdcabcb
SHA18dfc408292357397130b6f5950a49ebac6ffb568
SHA2566cc49a1ab3c9553d81d0056e875776389e5c052fa9fbe202be1ad3e0980c7d0e
SHA512386ae7f42f13d953c9103d2eac8aee381efac341b3f4241f35429f5d68651adfb6803e01512c067dfbb288957caa1cf6b3346e85f8b7b37ed09bfaed30df0cb8
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
4KB
-
Filesize
144KB
-
Filesize
592KB
-
Filesize
144KB