Analysis
-
max time kernel
150s -
max time network
105s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
09/10/2024, 10:46
General
-
Target
2fbd2b072bcfa89da7287da68acefb26_JaffaCakes118.exe
-
Size
158KB
-
MD5
2fbd2b072bcfa89da7287da68acefb26
-
SHA1
406e8dfed9d5c6588e1ef63db9678b76911bf963
-
SHA256
7c84c1e4539ac87dabfaaed7007d404461aed8803bad64cf864341e20cce921a
-
SHA512
aa08a4da9454feb37384a81983f392fb0ba09392f3ca3f6d593d0bbde122b30f5254cd82d318b52abd9ab24ab04f8e63d60f737efd3ca8d5890d6a1ce5f42ba3
-
SSDEEP
3072:WWNiRyIIvgiw0xdsJ61CyAqXR7OeSM5ZrXSxNl2sPNQWZ8g4gWMdFEEx/gQT2:WPIYTmiqXgeXZUkDWpWMdFXxJ2
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in Windows directory 4 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2fbd2b072bcfa89da7287da68acefb26_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2fbd2b072bcfa89da7287da68acefb26_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Iwokua.exeC:\Windows\Iwokua.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
158KB
MD52fbd2b072bcfa89da7287da68acefb26
SHA1406e8dfed9d5c6588e1ef63db9678b76911bf963
SHA2567c84c1e4539ac87dabfaaed7007d404461aed8803bad64cf864341e20cce921a
SHA512aa08a4da9454feb37384a81983f392fb0ba09392f3ca3f6d593d0bbde122b30f5254cd82d318b52abd9ab24ab04f8e63d60f737efd3ca8d5890d6a1ce5f42ba3
-
Filesize
372B
MD5ba49a874f9f04ad4f54b1f90080551bb
SHA16ce9ad5c1c788032e71c11fe75611e6c51f84648
SHA2564b334a8e5e62abf53d57fb1dd1de579a0e0936ad0e354b8bfab5b9c866874976
SHA5121b112e46c72ae5ecc0c2cc80684374a7dbd4da93d2e210e7d5e0bec7881df8145b886d20acf6bf6c2bba8b3d267fa994687ec32ffd88b194be4305421712ee6b
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
4KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB