Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
09/10/2024, 09:17
General
-
Target
2e8cde2455854e1831540f72ce6731b9_JaffaCakes118.exe
-
Size
6.0MB
-
MD5
2e8cde2455854e1831540f72ce6731b9
-
SHA1
5dd8048aff6d1c6e8ae74c35bdc7b25f72b2f6bb
-
SHA256
332290526bdbd5da81bdbb618a168579e9ff8e6c4026287176c9cb4d19df4309
-
SHA512
3e3ab155aae61dc8c9ab8feea9975f316483548b4334b8e29c2365d05fcb565bd1f789c24e1b60a55d62dbf891b5703cad15f218249199f4ffbce21be160780c
-
SSDEEP
98304:edG4J9ry1G4FA3sh1S7ipMDzBqxlabJOAyAFRYcH03lRAo2VjrX4:iZJ9ry1G43h1QipMDuladLtGngZhX4
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 32 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 1 IoCs
-
Drops file in Program Files directory 23 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 23 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2e8cde2455854e1831540f72ce6731b9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2e8cde2455854e1831540f72ce6731b9_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-L6U32.tmp\is-64QPQ.tmp"C:\Users\Admin\AppData\Local\Temp\is-L6U32.tmp\is-64QPQ.tmp" /SL4 $60294 "C:\Users\Admin\AppData\Local\Temp\2e8cde2455854e1831540f72ce6731b9_JaffaCakes118.exe" 6049878 522242⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\AnvSoft\PSP Moive Maker\PSPMovieMaker.exe"C:\Program Files (x86)\AnvSoft\PSP Moive Maker\PSPMovieMaker.exe"3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.2MB
MD56dd60f7261d1d860db3e4d89c8a07394
SHA1d12686f4d0455ec5b117e1fdb2e268953de3fe09
SHA256b2f2e9d61a74bad343499b8f0329c0908d78f88a19eae86371b5b638cf6f91f0
SHA5127bf183b9ee2cb9cc1ecdd5c00918bdcb04dc7c33bf8e08b2d514912433471211409af44eb97d1d49c11cd79360b3509c1f4be38dbc239ce39b60d3f8e582fae6
-
Filesize
2.0MB
MD5f83186b66783aa6645cc3d6133b3d5d2
SHA13ecabccae60ffe41ebc4a94a63578b9224e1340a
SHA256cdd1d9dcc0e8bac8824a71cf7acafa1731bad7ea9e0f9fa872dc0c7970f27457
SHA5125330f5b8fd947deeee6a8ad52e7ad10b6fc197645f441bea2a1af6aad410edf3804298b188765864ed696984d166094ce187a37d5b373a585627a65462d1897e
-
Filesize
120KB
MD591303ff625f6273bb5884cc9fe238290
SHA121df7efbdae95efe06e385c178732b2f4f332030
SHA2567e6ffab827b05cc01151c7d61a5ec679bf9f1d33af0c9914d281d356fdb95d92
SHA512233dadfb12f7e5abc58e6fb50f4ca9196574caffad2aeadc73eea3a2174605be375c1d4f7b7b22323a0b3441bbc8f633a44aa573519db48163d4b1406673c0a6
-
Filesize
404KB
MD51b45ca78ec3744edf6a95768507a98a8
SHA1e1bf4fcb93654b05b272fc0befdc03dc419be5fd
SHA2564224450a4ee176058959a8a016679cb5ac876f5ba75178338bfca2b463cee116
SHA51243373acb704e8141b8b3a3c9b2244606b2de6c3c42cdf7462512225ca9148dada8d3a0b446d9588911cd58f0e00635ff39b93804b082530788ab1a9ba5d82830
-
Filesize
88KB
MD5c9d14a263cc30f511404afe6b9c20dba
SHA1809a8e3f0ba8840efa77496764b0b59748aa2dfc
SHA256c66efc2600efba0ad15d375b7c6dc57ce734256e0485da52d1881c1f63e367ab
SHA512839da4d6d79fe5332c29d52a4a254c3595a6f095c6432453aa08ba0491296b0099a397134d1662d144364d4afaa6a236ebeef81b7ecb46cf953e489dafc1623d
-
Filesize
1.2MB
MD59696051c8c0bb8f0c1df769ca9ddb942
SHA1d4b955b3801d2a9a2d05ba3d125685ac0c148e3a
SHA25697c2ac0a9415faccfe4a6b64f61c3dbfa3d798e308b2e0c7ceaa0949b4f47032
SHA5127a0892ef54e3af999b823c8ee50584d497c9e51a75ade6a5f6332e03a8e1c3877566f85ab766c9128d0f1d9133c55f249caa275eb372f917c574dc97a8ff75e7
-
Filesize
124KB
MD50e8594d5d9f3e881a43041686cb46770
SHA1ea5178510527fdd7a90e81854b84f18d60f43e35
SHA256512cdc334c67b491158094622fd277ec806fc1eb326015487b5d3f1b9cc1ea94
SHA512c064747e9db77f2c90b0034276d6f41adb6e94397ef10dc3d2eb85356014ad37864e4c2b0d40c377aacbbba1b56230e3623033e88e6869c3cfee43dd719c017b
-
Filesize
1.9MB
MD5bacc749d9e2da49fc3cd7432aad267eb
SHA157b34cb579cbcbdd8688bd4a66a041c3b360560e
SHA25672416efb5dd776771ec7d50a5d55ddc7a8a24d3cb7c9657cc973856b616512c4
SHA512866d1a2798034724c859fab9d3c92e5a15ffe646d510725b654504ee4ccbea76fc69eeb9fbdd8ee232e4103e7899e8142ab30f262db63caebc181899c8ad4dbf
-
Filesize
796KB
MD5f09475e08233b5dc75a4e5b57df1b5c8
SHA1fb8f2f4271118bd86c6c81973af0d3284a310db4
SHA256d4f5542cf2df2a176c0e470662c9923498273e9f2943e6d1f66b9d00a216bfe8
SHA5122f1a3ca4165ca4c9f7dc6d85c3e833b8aecda7ef744eb01906f745d9297ef998778d4b2b0fea26b046ac3464482f437382c62a3401f13dfe67a4430456704691
-
Filesize
2.5MB
MD5cf87f3304a7b5992ca40c093eb93010c
SHA1152b32996e8ef3bc4725b4ce914b4ab9e7c26bad
SHA2567e6bfa8f0809b62ddbd766c2db47e7508dce75c6bd7be9da3fd18fcfb5360845
SHA512951d7e0b9838902ac67eb52be61a7ef8dcc3bc53d71c1c723fa285ad249cc1e2083f325007e954ddff7a5b208cda8c6a9a8336946838cd0eb1aed589124becfc
-
Filesize
524KB
MD545e47278cb08025c6e851f944d4064ce
SHA166e75ef7aaa3c098df7b409b4ef21c090c64676f
SHA2561842be9d64c4eaba10fcc41122139541b17ccb0f56b3c46dbb67d264a91624e2
SHA5127aaa72fca087216615f1e93e576a02878b6ea45019e44367f2c33734f8f90c566fb8b2a18fdbd1238f463d8d1b17004c7b9c3dd19946d9846b31d6b8fe50bbea
-
Filesize
76KB
MD585ed2deb9571fe1f109dd896d2bd4a4c
SHA10f7923452aab53e981e1254d58a5b50d6f810aab
SHA256b1de1482c0606e2a9f037acf1789a0af353e1cf8b41de7bb32786d2ea99c3b7b
SHA512c7d06ab115c7456a159e14b9da5d56f2406c1fb2c6b405cef0eeceec1c505df9ffa12bcefa637c1952d2d65cd32ad0d3bc8696e5c39639069bbd7e4814c4e148
-
Filesize
643KB
MD5036ef63e2f9b138a42d6adb54ec0cd1e
SHA1353db5d438205a726a6d54beb62f9c62638f501d
SHA25671b487f0523f213004766402b22bf86fa0ef9891e940d2a4cb12eba6627e7cc6
SHA51231b8f6e76c8c4f5323f12384c41f6f2b04e58545c121da71e2a4da947a9c0aea9eb05df4f8199cc6dc89bc238577c4e2d5fb4b66e77e1130bc72b6c38f207cc9
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
2.0MB
-
Filesize
764KB
-
Filesize
2.0MB
-
Filesize
124KB
-
Filesize
396KB
-
Filesize
88KB
-
Filesize
836KB
-
Filesize
1.3MB
-
Filesize
120KB
-
Filesize
1.3MB
-
Filesize
7.8MB
-
Filesize
7.8MB
-
Filesize
7.8MB
-
Filesize
7.8MB
-
Filesize
396KB
-
Filesize
7.8MB
-
Filesize
7.8MB
-
Filesize
1000KB
-
Filesize
396KB
-
Filesize
396KB
-
Filesize
764KB
-
Filesize
764KB
-
Filesize
396KB
-
Filesize
764KB
-
Filesize
764KB
-
Filesize
396KB
-
Filesize
396KB
-
Filesize
764KB
-
Filesize
7.8MB
-
Filesize
764KB
-
Filesize
396KB
-
Filesize
396KB
-
Filesize
396KB
-
Filesize
396KB
-
Filesize
36KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB