Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
13/10/2024, 15:38
General
-
Target
40acf025643f8f39e7f1422579bfce2e_JaffaCakes118.exe
-
Size
63KB
-
MD5
40acf025643f8f39e7f1422579bfce2e
-
SHA1
e5366357613fae970e37cb37a70d20fb917f147d
-
SHA256
0642f4144e3937d0fb0263b8e54e4576337a4e6cb0fe253a21b53cf3081d7eff
-
SHA512
94d66d799446850a59861fa39f12b57d836c30406c74aacccc6187d867866875d21fa5740f601bca7c32998fc5650266e618c69146d53f12d0fd0980f85ea4ff
-
SSDEEP
1536:I2paINBwYhAiCYUjc6gGN/YEKVUQ0t/lG07Z+yIhxZ3Ir06j2h:IH+Bw8UY6gaYFT07cyIN3IMh
Malware Config
Signatures
-
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
-
Loads dropped DLL 3 IoCs
-
Drops file in System32 directory 4 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\40acf025643f8f39e7f1422579bfce2e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\40acf025643f8f39e7f1422579bfce2e_JaffaCakes118.exe"1⤵
- Server Software Component: Terminal Services DLL
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
123KB
MD57a72fac0c59f56e663bf84ccdf76a9a2
SHA1f0993df31e872b47bd8e8523baa178513de20433
SHA256be673e4158c32c445758e2e6bd3b71a332cb80ce7ed027821d2be67c6f2e6de6
SHA5126e18762a63c87e13f0a77f5a171740665deefa9e37ef1ab7119d01e83d26cbca6598fc257083938fe3a70ad5975c598e61b07e8b7b2387deb9ae01c6a82f81d8
-
Filesize
236KB
-
Filesize
4KB
-
Filesize
148KB
-
Filesize
236KB
-
Filesize
148KB