Analysis
-
max time kernel
0s -
max time network
4s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
17/10/2024, 22:55
Errors
Reason
Machine shutdown
General
-
Target
541fe431ed2c7153c10c5222a06a6ca4_JaffaCakes118.exe
-
Size
96KB
-
MD5
541fe431ed2c7153c10c5222a06a6ca4
-
SHA1
a08473337b78dcd02479d2a5b5def7d378e5ee87
-
SHA256
7b53e54c81e5c915783da111dbfbffcc04c2a5bca719a66f78dd094a22f92294
-
SHA512
b63b64bef10ca90f12fb144ab41dc10a226bd171456b555ea79443f82548d29576a9ade22f623e4831a7ffa699c739ef559b152b9c80a35c983d56d0af95de65
-
SSDEEP
3072:o/JLyrAvp1+tKZlLOgr4NaKSDbxrEz+C:o/ZyrAhksL43SDREz+
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
-
UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\541fe431ed2c7153c10c5222a06a6ca4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\541fe431ed2c7153c10c5222a06a6ca4_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa391f855 /state1:0x41c64e6d1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
276KB
-
Filesize
20KB
-
Filesize
276KB
-
Filesize
276KB