Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
09-10-2024 10:36
General
-
Target
2f95069e8373f2b35e59e6d6bd71e1d0_JaffaCakes118.exe
-
Size
4.8MB
-
MD5
2f95069e8373f2b35e59e6d6bd71e1d0
-
SHA1
fcbe39d44aee26450619bdffb671513e1296a283
-
SHA256
1b0c54e9fb3841917d4b392ecfc8b4aa039f00b04684cc141a718b022493ccea
-
SHA512
9ef838114a8cdbaa8e06bf9a0b45adc2047b9ce3e7c87cd6e87ee2133bdc07498b9ee8aa0f63a7f7412ef7d31f8837f63e6935c7bfd15ec6673f6f41f386ca48
-
SSDEEP
98304:7rONEVJyZlng4p2VbC2FQD9PvsXDW2stC5mn:SEVcn1pYFQDZcWXtC5
Malware Config
Signatures
-
Detects Eternity stealer 1 IoCs
-
Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2f95069e8373f2b35e59e6d6bd71e1d0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2f95069e8373f2b35e59e6d6bd71e1d0_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vecvhw1i.2a3\Extreme Injector v3.exe"C:\Users\Admin\AppData\Local\Temp\vecvhw1i.2a3\Extreme Injector v3.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
MD5ec801a7d4b72a288ec6c207bb9ff0131
SHA132eec2ae1f9e201516fa7fcdc16c4928f7997561
SHA256b65f40618f584303ca0bcf9b5f88c233cc4237699c0c4bf40ba8facbe8195a46
SHA512a07dd5e8241de73ce65ff8d74acef4942b85fc45cf6a7baafd3c0f9d330b08e7412f2023ba667e99b40e732a65e8fb4389f7fe73c7b6256ca71e63afe46cdcac
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
240KB
-
Filesize
72KB
-
Filesize
1.9MB
-
Filesize
4.7MB
-
Filesize
10.8MB
-
Filesize
2.1MB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
320KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB