Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
12/10/2024, 16:39
General
-
Target
3b0a7b43972933a5f82d00eccc68fb46_JaffaCakes118.exe
-
Size
747KB
-
MD5
3b0a7b43972933a5f82d00eccc68fb46
-
SHA1
c40c8ff1a4d329e32610491e152ddf509f279be5
-
SHA256
495ab9b57e4d7738a7b313c258512d22d2168eedc2c53afa69408d6345669c05
-
SHA512
cc47502048ce7758d8364b2c55885c38cfa6d6bc5adc02e146035972f663fe94a1ad65e89fd7254ef4aa3e8b15942c203c7908d83ed2db4fd63cd7eaf02ca41c
-
SSDEEP
12288:0U2/svcRBlQrRZAjxVPQ7zbjvuQFTmjQ8CDc8+1IJ5XD1OouTGAy2z0jesK6ix:v2/svrO5QbjvPFTmjQ8IHDUTGF2z0j1c
Malware Config
Signatures
-
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\3b0a7b43972933a5f82d00eccc68fb46_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3b0a7b43972933a5f82d00eccc68fb46_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
-
Filesize
720KB
-
Filesize
2.1MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
2.1MB
-
Filesize
720KB
-
Filesize
2.1MB