Analysis
-
max time kernel
142s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18/10/2024, 01:30
General
-
Target
54bc39ddc49d1109d3e0af35279c7992_JaffaCakes118.exe
-
Size
326KB
-
MD5
54bc39ddc49d1109d3e0af35279c7992
-
SHA1
f2ba1932a0bbed87053a4046d77d4a52f6a037b0
-
SHA256
6d4afa99c692b7bb0de354d85ad1d236e886d2cd7e4e84266c4fbc919d8a6601
-
SHA512
7cb8f7b8227f2ae309645f1434e11997952bbba23ff9fc9705ce175c36910e719c1a6f33df8c9798974dbe43c9cddd4c031dc2e306fc6b7bbf65fad634a77bb4
-
SSDEEP
6144:DYDhB6ActM8FbPt6a15RGkPNJAcb+k2WzoPiML3AYRYAe5mYklIZarChO:c9BvctM85t35JPNJj2WzoRLQYRYzmYt4
Malware Config
Signatures
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of FindShellTrayWindow 12 IoCs
-
Suspicious use of SendNotifyMessage 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\54bc39ddc49d1109d3e0af35279c7992_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\54bc39ddc49d1109d3e0af35279c7992_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
764KB
-
Filesize
764KB