Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
30-11-2024 05:12
General
-
Target
b4eeb223214de04cf75bf5686aabfb84_JaffaCakes118.exe
-
Size
123KB
-
MD5
b4eeb223214de04cf75bf5686aabfb84
-
SHA1
648bd3b38fd513013789ab6030dd34d6af4b7890
-
SHA256
c5202071dc7781425ae45a18348036178c2ad389116dbe32eaa14c074dd43197
-
SHA512
4d9cccb0d59acc2c25bf78c9fa90c8c8fa7ec6f596f14b8fdcba8dac5cf07cc5556a46388bde04f90e6ab367e65fcaa4467a6248ea8d00107dcd1ded446ea2bb
-
SSDEEP
3072:1W3a80pMO6ED0S6TMxa34Tka9X0SIxd720I6i:g3P09D0S3xa33sD672
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in Windows directory 4 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b4eeb223214de04cf75bf5686aabfb84_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b4eeb223214de04cf75bf5686aabfb84_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Bziqoa.exeC:\Windows\Bziqoa.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
123KB
MD5b4eeb223214de04cf75bf5686aabfb84
SHA1648bd3b38fd513013789ab6030dd34d6af4b7890
SHA256c5202071dc7781425ae45a18348036178c2ad389116dbe32eaa14c074dd43197
SHA5124d9cccb0d59acc2c25bf78c9fa90c8c8fa7ec6f596f14b8fdcba8dac5cf07cc5556a46388bde04f90e6ab367e65fcaa4467a6248ea8d00107dcd1ded446ea2bb
-
Filesize
372B
MD54df94890c65db78a4c4a625d5501df13
SHA1c88c018a5c87fdc6cb71ea4df29a495f87d3cdbf
SHA256053cb92b3c1c2ff4f016b8d5491bc376b1513373452de5585eb07dacc41c2332
SHA5121f008517f484ad8b8ce66f3feed606c340ef1e6f00bd8eb30e7592dffe940a4eccdcedc2a5114cba9b93e89667fdb99dfafe85df60ddfe748d596366a9ee3b91
-
Filesize
96KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB