Analysis
-
max time kernel
149s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
28-10-2024 00:00
General
-
Target
76a0f318ccfd9fc95316e17f8e37b027_JaffaCakes118.exe
-
Size
1.9MB
-
MD5
76a0f318ccfd9fc95316e17f8e37b027
-
SHA1
2cea245a4e1de4749d98c550cc84d8cb7ce9569a
-
SHA256
72ed6850b21610aad10f6e8b079401cc2498d65c07983c3c4db740153be464a8
-
SHA512
9da5e433bcbcec953849ed2d7f56349786ae900cc4d2dfa333064f2e3251bf32026dca7c747cfc5dbab18ee2950175a9a478a09613168d096634f1d02fcf83ae
-
SSDEEP
49152:6BH9zPqoEUP/QsGDFxUGXET3pb2uQUr3ZAK6SQKS:KHZhgFxUfT3gu3r3ZAn
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Drops file in System32 directory 2 IoCs
-
UPX packed file 13 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 7 IoCs
-
Suspicious use of SendNotifyMessage 7 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\76a0f318ccfd9fc95316e17f8e37b027_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\76a0f318ccfd9fc95316e17f8e37b027_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Cloud AV 2012v121.exeC:\Windows\system32\Cloud AV 2012v121.exe 5985C:\Users\Admin\AppData\Local\Temp\76a0f318ccfd9fc95316e17f8e37b027_JaffaCakes118.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\YaQH6dWK8fLhXjC\Cloud AV 2012v121.exeC:\Users\Admin\AppData\Roaming\YaQH6dWK8fLhXjC\Cloud AV 2012v121.exe 5985C:\Windows\SysWOW64\Cloud AV 2012v121.exe3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5a5f231a76360a13aeaad800a3af8665a
SHA1e44a5abd0705e34b95fc54ae957512c651f1b70c
SHA256075ae7acf4d7d5815282f41149c9577c1aeff82263c9ba221ea58186b5b8062c
SHA512fa9dff28eda53dca04c55899a547cbbd2066c9fd603a7ceb6a9ba1b388c9c4e43e713cc511be12ba22b34b8acf2022c8af0fb451283bc94d1ef53db0c0260bbc
-
Filesize
1.9MB
MD576a0f318ccfd9fc95316e17f8e37b027
SHA12cea245a4e1de4749d98c550cc84d8cb7ce9569a
SHA25672ed6850b21610aad10f6e8b079401cc2498d65c07983c3c4db740153be464a8
SHA5129da5e433bcbcec953849ed2d7f56349786ae900cc4d2dfa333064f2e3251bf32026dca7c747cfc5dbab18ee2950175a9a478a09613168d096634f1d02fcf83ae
-
Filesize
1KB
MD5c132c5b65071bd6691d07733d7541696
SHA186cbd732633e4329fa4a893360bc4838ad1705a0
SHA2563d4a645b08db9e98d427bbdd225afca72d95c2592e9c131782b47982f5f259a3
SHA512f74ca171e18d0ea9c9960b6cf7447e2a4e7fecac8737e030bcc0d337d9f3b7e76afcf6006259f8b08cddf81085baf0ed8a40fe14ccff4d87c916da40073461f0
-
Filesize
1KB
MD550ab0dd716dd66ad0c3eb5fb63f2f118
SHA1bd9641078264b2135d3b3b0007c98f977d057960
SHA2561f9037b078250201c92f8e1ea1ad3023011039c76a5aa74d3710edc452fc6517
SHA51224c0b8ca8650fb50f81b9a89bbb7e8e5492b303b065fbf846c55aeb76c9fc41ebb5b9c6163d168a1362941720473486fdf2596dab4764176ebb348ad264b61d6
-
Filesize
5.1MB
-
Filesize
5.1MB
-
Filesize
5.1MB
-
Filesize
5.1MB
-
Filesize
5.1MB
-
Filesize
5.1MB
-
Filesize
5.1MB
-
Filesize
5.1MB
-
Filesize
5.1MB
-
Filesize
5.1MB
-
Filesize
5.1MB
-
Filesize
5.1MB
-
Filesize
5.1MB
-
Filesize
5.1MB
-
Filesize
5.1MB