Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
03-11-2024 21:05
General
-
Target
8d823732d7c08e9d006ad28dcfcd9853_JaffaCakes118.exe
-
Size
1.9MB
-
MD5
8d823732d7c08e9d006ad28dcfcd9853
-
SHA1
50bd2a3e3d9cb967c8aa9fd72bb0a2626d350da3
-
SHA256
645397aa16ec0291f74945cc4d4a535d7a8b26b1ac11629be76a91f50124c658
-
SHA512
9be430e058188fd78d2134eb002f55c8206f1b16edd9f9d27f1cdcf18a1c840202ddfabd7cfa6012c64467f426db58d5ba76f961844f09859cbade5dc72aada3
-
SSDEEP
49152:6yH9zPqoEUP/QsGDFxUGXET3pb2uQUr3ZAK6SQKS:RHZhgFxUfT3gu3r3ZAn
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Drops file in System32 directory 2 IoCs
-
UPX packed file 12 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 6 IoCs
-
Suspicious use of SendNotifyMessage 6 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8d823732d7c08e9d006ad28dcfcd9853_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8d823732d7c08e9d006ad28dcfcd9853_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Cloud AV 2012v121.exeC:\Windows\system32\Cloud AV 2012v121.exe 5985C:\Users\Admin\AppData\Local\Temp\8d823732d7c08e9d006ad28dcfcd9853_JaffaCakes118.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\QP0cS1ibDpGaHdK\Cloud AV 2012v121.exeC:\Users\Admin\AppData\Roaming\QP0cS1ibDpGaHdK\Cloud AV 2012v121.exe 5985C:\Windows\SysWOW64\Cloud AV 2012v121.exe3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
612B
MD503b75636cee74b971fdf8fe2dc2dc8a4
SHA1bbca415646755972a2060531a88bf0e2677fd342
SHA256cde28bf611f4f5fa186fef029c6cf2f84d66f016ce273124f80cc9fc3c0ef296
SHA512b6490f668a8d2a5d5e249872750178da25d15bfe10b489a00e8d7f1e8a4cb1d7fb69d06cf4902b96d010b51d79d92d3732d178f6743ac668e61e114b00854bab
-
Filesize
1KB
MD5802acccbef7c7b3447e926a30dfe62c1
SHA1139f5bd081e05717e5d9698b434b3c0bb3870ad8
SHA256e830d55797079dc324c6deb0984e766fccf7f762b3298a960c53f0854632e0e6
SHA512102723aa21057a6f8841b6bfa510c96f6cf4a46c42a63747346a69a22d17f4484005137d712b8226d4ec0e5c26f5293ea574ca21731a9aebd5049954ba7746fa
-
Filesize
1.9MB
MD58d823732d7c08e9d006ad28dcfcd9853
SHA150bd2a3e3d9cb967c8aa9fd72bb0a2626d350da3
SHA256645397aa16ec0291f74945cc4d4a535d7a8b26b1ac11629be76a91f50124c658
SHA5129be430e058188fd78d2134eb002f55c8206f1b16edd9f9d27f1cdcf18a1c840202ddfabd7cfa6012c64467f426db58d5ba76f961844f09859cbade5dc72aada3
-
Filesize
1KB
MD588059ae1e846d058a259714b0abcca4e
SHA13b3a5ac74228d6a48d52b92896262a78ea706896
SHA256a535511541bf82de1ee0004e03485c39fc689d56cda3cbc7164557c155525ddd
SHA5120c480f1ea2b0d73523fbc58becb78052d9b89735a889afabd9eac559fa7d70517c12fb6dfe8a947d9a1e7c58780a41be7a7001082c5168a2800c263c6c620cbf
-
Filesize
1KB
MD550ab0dd716dd66ad0c3eb5fb63f2f118
SHA1bd9641078264b2135d3b3b0007c98f977d057960
SHA2561f9037b078250201c92f8e1ea1ad3023011039c76a5aa74d3710edc452fc6517
SHA51224c0b8ca8650fb50f81b9a89bbb7e8e5492b303b065fbf846c55aeb76c9fc41ebb5b9c6163d168a1362941720473486fdf2596dab4764176ebb348ad264b61d6
-
Filesize
5.1MB
-
Filesize
5.1MB
-
Filesize
5.1MB
-
Filesize
5.1MB
-
Filesize
5.1MB
-
Filesize
5.1MB
-
Filesize
5.1MB
-
Filesize
5.1MB
-
Filesize
5.1MB
-
Filesize
5.1MB
-
Filesize
5.1MB
-
Filesize
5.1MB
-
Filesize
5.1MB
-
Filesize
5.1MB