Analysis
-
max time kernel
144s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
14-10-2024 17:01
General
-
Target
433d970910b60cf230e63059dd902387_JaffaCakes118.exe
-
Size
2.4MB
-
MD5
433d970910b60cf230e63059dd902387
-
SHA1
12fab24d955be94124d249ef71fb4b3ee8ae914d
-
SHA256
7a6c2787558600aca9a836e83593072fe54f9981b31792b9ea9e1c9f02492459
-
SHA512
aba8e51c1afc344be11eb01296c73792617357404c858f53765206dc8ccbccaa5e56f3ed44b5b6ba4182f3686434e0dd347072cc52218146e97691d9e44abb8f
-
SSDEEP
49152:bw1dILPAX8ln6aB4WP3E29V8S4Dhg0fn2J6Z2SLqFYziUk68yogVTpypN9C6vfwT:bybk6zVMNcSfJ7JpyXS24kxK8UF8/Um
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 9 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 45 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\433d970910b60cf230e63059dd902387_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\433d970910b60cf230e63059dd902387_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\ee458jpdesk\jpdesk.exe"C:\Program Files (x86)\ee458jpdesk\jpdesk.exe" /NoWizard /AddGame /AddShop /Addtuangou2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 6483⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5088 -ip 50881⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
903KB
MD5fd11f6fe68c6a543576fd06e9258b359
SHA1df92e8b8f6e1e16f00667387f249c1f6b9cc8892
SHA256a5e2d6c7db54bc2e15ff5b7bd0f0bf4c416b842fdd2a609e5d85b67b9650c686
SHA5124480373c91cc23174c08852cdbabbb0cca10b938c9c1ae73dae775bf83dd8977f65fc54955fe593dc32bede246002c310d32bad33a21c183c212ff0092ff6c2d
-
Filesize
32KB
MD583142eac84475f4ca889c73f10d9c179
SHA1dbe43c0de8ef881466bd74861b2e5b17598b5ce8
SHA256ae2f1658656e554f37e6eac896475a3862841a18ffc6fad2754e2d3525770729
SHA5121c66eab21f0c9e0b99ecc3844516a6978f52e0c7f489405a427532ecbe78947c37dac5b4c8b722cc8bc1edfb74ba4824519d56099e587e754e5c668701e83bd1
-
Filesize
14KB
MD5254f13dfd61c5b7d2119eb2550491e1d
SHA15083f6804ee3475f3698ab9e68611b0128e22fd6
SHA256fd0e8be2135f3d326b65520383a3468c3983fa32c9c93594d986b16709d80f28
SHA512fcef8ac5bd0ee6e316dbbc128a223ba18c8bf85a8d253e0c0877af6a4f686a20b08d34e5a426e2be5045962b391b8073769253a4d9b18616febc8133ccf654f7
-
Filesize
303KB
MD5064c5337ed2c6f123f5270d7dcec2a40
SHA151efbdc6f795510b84f6c0e3b9796f8720a55983
SHA256e73b9d938fcccf600d3fa743965b7190f376c830091b05f828b052d1f439d389
SHA5125c840dfcc346ddc1a4de2ada1ea311cf1ab049866ce9bcf02c9d20422a92f521e35413323d818393ba0b452499c394eadc39a94200afd35cd6fb1e143e11bd7f
-
Filesize
392KB
-
Filesize
392KB
-
Filesize
3.1MB
-
Filesize
4KB
-
Filesize
3.1MB