Analysis
-
max time kernel
150s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
10-10-2024 14:43
General
-
Target
30689d5387b5fcf72042e91e7e0e9bfe_JaffaCakes118.exe
-
Size
272KB
-
MD5
30689d5387b5fcf72042e91e7e0e9bfe
-
SHA1
8ad20a9b0a71cfc6b2e6c303971d57128daf79d0
-
SHA256
9bb9c3895e3b3881593bc95f58efe149ef15439ed5b53c2d9387f83e5ce1bb8b
-
SHA512
47963523f8af9f7b7fb6a20bb9356a7503d717346a6280bb9d4c84e4a727849f235aefe32743818e89868c2ce2e9860c9d317843f41607e0dfe7596d9ad14c4f
-
SSDEEP
6144:Q6Q4uYV6jvSDxs36+7HqPFpawolmR8e2bLqU/i:Q6Q4/V6Tos36+7HAzawBR8P+r
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Drops file in Windows directory 6 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\30689d5387b5fcf72042e91e7e0e9bfe_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\30689d5387b5fcf72042e91e7e0e9bfe_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Windows\Jzesea.exeC:\Windows\Jzesea.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
272KB
MD530689d5387b5fcf72042e91e7e0e9bfe
SHA18ad20a9b0a71cfc6b2e6c303971d57128daf79d0
SHA2569bb9c3895e3b3881593bc95f58efe149ef15439ed5b53c2d9387f83e5ce1bb8b
SHA51247963523f8af9f7b7fb6a20bb9356a7503d717346a6280bb9d4c84e4a727849f235aefe32743818e89868c2ce2e9860c9d317843f41607e0dfe7596d9ad14c4f
-
Filesize
390B
MD53b0f5fb2fb01f9cae18456a8d4ac7452
SHA1e68139e751cf870ea2de96a147817eb4a8d2dd8a
SHA25620097adfeef92d8620ceec429a3c6b5b3136dbcad357ea04006f8aca2af6bc7a
SHA512591580b8073d20aab115e99be3fb6f570b89f74c2ad3a0291337290eb1944fdeee2506aaa508dd1e097d8c8850fe7deeecb4f738462981b78c5483a2bae46518
-
Filesize
24KB
-
Filesize
284KB
-
Filesize
284KB
-
Filesize
108KB
-
Filesize
284KB
-
Filesize
284KB
-
Filesize
284KB
-
Filesize
284KB
-
Filesize
284KB
-
Filesize
284KB
-
Filesize
284KB
-
Filesize
284KB
-
Filesize
24KB
-
Filesize
284KB
-
Filesize
284KB
-
Filesize
284KB
-
Filesize
284KB
-
Filesize
284KB
-
Filesize
284KB
-
Filesize
284KB