Analysis
-
max time kernel
150s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
14-10-2024 14:51
General
-
Target
42c0a038ee5943d0afa6444c214e3a7e_JaffaCakes118.exe
-
Size
358KB
-
MD5
42c0a038ee5943d0afa6444c214e3a7e
-
SHA1
ceb5580c61d024e6e63ec120d5050f065cbc9921
-
SHA256
642aaa7b2e9fc079b54d4e5fb9c40513bc92e6598ffbc8bf63bd87e672a3e8de
-
SHA512
ce32df6cb230088b928669b7ccba93a3dd4c9d1dadd0a62d960dce2dbdbaf3cb25a3d8e8237f81d041f27361bff48f5c4d11dcdfd6e7d0f896b8089d8ce2aa28
-
SSDEEP
6144:y01Yk7BnS1reexa5IMl7elkTLPHOqwGzKYz5IeF61KAQkvgprf:/1bnSUexa5NjTDuqwGzK0IUpkvgp7
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 4 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
UPX packed file 11 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\42c0a038ee5943d0afa6444c214e3a7e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\42c0a038ee5943d0afa6444c214e3a7e_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\kCo24500pDbIj24500\kCo24500pDbIj24500.exe"C:\ProgramData\kCo24500pDbIj24500\kCo24500pDbIj24500.exe" BOMBARDAMAXIMUM2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\ProgramData\kCo24500pDbIj24500\kCo24500pDbIj24500.exe"C:\ProgramData\kCo24500pDbIj24500\kCo24500pDbIj24500.exe" "C:\Users\Admin\AppData\Local\Temp\42c0a038ee5943d0afa6444c214e3a7e_JaffaCakes118.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192B
MD53eb11c992ce833df2721d7a2accc7434
SHA16538933ad619051e565985c4a6b44989193dea42
SHA25649fa881e80104ac8e962612a6852e361e5a09ee52b03c8ec2a686eb186cb1602
SHA512a1fdcab042e1ed2edafb360ccfc7cd0cfab36375b595f4b06df183e15f9f45b31cec0f29cb11a3af44bd3f89af729eba553309990e99bdc558828e0e9c101de5
-
Filesize
192B
MD5a22dcfca436e4878f6ebde429f78c9f1
SHA1da99b43d844f27ff81af6e9c863dc0c5349502b2
SHA25651d1180cb3e4c0a14b447798af0ca1ed7c7c28df83342450f2bef203649c82e7
SHA512d60b2c1e7a548d7eb6e8b15ef94c04deeedcd6e166672029e6821eedc614b3ab11fb7a6f2c13f03160a3f68cca6e9036aa1cf241ac990b7087667b83bde7b9b0
-
Filesize
192B
MD5f89ab042eb80580d87d4fd0f4b990e29
SHA164283269f79782d3c8faa6ffa7b557ab0eb8f3ad
SHA25686bcc722da7f108606d8b5dc643ebf8ece76205924a4b1c9e23011884c692ffc
SHA512a7ace046fccb46dd199873780082bbdc5587f7503788c18d55ede29d302db5a012d0a38abedd0567f6322ed12d17f141c5e262f079efb66156f9e673544acdba
-
Filesize
358KB
MD542c0a038ee5943d0afa6444c214e3a7e
SHA1ceb5580c61d024e6e63ec120d5050f065cbc9921
SHA256642aaa7b2e9fc079b54d4e5fb9c40513bc92e6598ffbc8bf63bd87e672a3e8de
SHA512ce32df6cb230088b928669b7ccba93a3dd4c9d1dadd0a62d960dce2dbdbaf3cb25a3d8e8237f81d041f27361bff48f5c4d11dcdfd6e7d0f896b8089d8ce2aa28
-
Filesize
920KB
-
Filesize
920KB
-
Filesize
920KB
-
Filesize
920KB
-
Filesize
920KB
-
Filesize
920KB
-
Filesize
920KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
920KB
-
Filesize
920KB
-
Filesize
920KB
-
Filesize
920KB