Analysis
-
max time kernel
150s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
10/10/2024, 17:37
General
-
Target
311f10f2a0b76993f2bd85eadf68292e_JaffaCakes118.exe
-
Size
424KB
-
MD5
311f10f2a0b76993f2bd85eadf68292e
-
SHA1
7a09a1375924285e5865317c2c06fedfb4058beb
-
SHA256
dcb6dcc456ae91df2d5cec7739e84723d206277faeb30bd2223405ddd330bdb6
-
SHA512
496e28d1a6445f54dddfd72b36fd3db17ad241d736d92b9412de4ec62c1f3c3deb8203fc47a64b06b7b56f7b0ee079803f3be1cb46b6a4d06acd438c65717337
-
SSDEEP
12288:N6h5mf3I2iwDzgn3Y5h6sriJdP9SKM9kw:4Xa3Kw/gnShk1SKMd
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
UPX packed file 9 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\311f10f2a0b76993f2bd85eadf68292e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\311f10f2a0b76993f2bd85eadf68292e_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\eEaGiMd10400\eEaGiMd10400.exe"C:\ProgramData\eEaGiMd10400\eEaGiMd10400.exe" "C:\Users\Admin\AppData\Local\Temp\311f10f2a0b76993f2bd85eadf68292e_JaffaCakes118.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
424KB
MD52a30460fe7535c50d18b3d5d68fbf377
SHA1d14958d6f6f29e4348da540dad4e5e442e2aefa2
SHA25685014f73945c2a5d3eeb16a3f5c4b9f2c24f2190e79f53b3db81f67f07014938
SHA5123a29456d1d8ee27a81fe8c9d826774e4128081224ec2eea9302abd5956cf144e83f236ada4028e7e4dace62b359b9b38a94e0f13dbe06b9dadd6c46f30da3fad
-
Filesize
716KB
-
Filesize
716KB
-
Filesize
716KB
-
Filesize
716KB
-
Filesize
716KB
-
Filesize
716KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
716KB
-
Filesize
716KB
-
Filesize
716KB
-
Filesize
716KB