Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20-01-2025 09:07
General
-
Target
JaffaCakes118_e285d42322419bf6e8cedb0a0826c344.exe
-
Size
387KB
-
MD5
e285d42322419bf6e8cedb0a0826c344
-
SHA1
0f7e391ffca383903f04f45352f089e3624e28e0
-
SHA256
763b6d74cc8b3d878aff174fc2979e717d6082ad7eb89c02c0817d7ffb4d2bf6
-
SHA512
4c123d42788bd47ded547a259f14aed186a3fe5fedfd758b29b1f6705bdb39a035349b93fcc8fcbdff695c52c453a1cae61b1d8dfe62a8840c32c2590360b743
-
SSDEEP
6144:Bj3wFq+eFrE228WT7NAYkkhAuXdkR1r/FbMZYEjr+nuCME3HwwirefXmckuEzfmx:BjwF3IEGR1rpM1jr+1MEXzsg80
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e285d42322419bf6e8cedb0a0826c344.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e285d42322419bf6e8cedb0a0826c344.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\hD01812HeDhG01812\hD01812HeDhG01812.exe"C:\ProgramData\hD01812HeDhG01812\hD01812HeDhG01812.exe" "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e285d42322419bf6e8cedb0a0826c344.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192B
MD5b0067029628324bf5436ceb0f17cb7d5
SHA1dc36648dcf0ecf4b2b4b3c264d42051c23b280a8
SHA256895b07ea9afa0f3e1242f577ab7dae6baebe2e2c206a76d365e28418ef396cd1
SHA51298570714d8b7157e15ae2ed7363cca37c6cc1836255bb3abb41c0f3b1bb6992ba154adf42924e885f47db52953b4af65d30677674ae2a98df2fede70a89fae6e
-
Filesize
387KB
MD5883f30d5ec6dc182207f08ea0fb7309d
SHA1dcc1f68f4857c23121f8705cdebbfd0f14c97008
SHA2569f0e2de4e9fc2da3c8c9f59ade3fa34484b988dc6921f157fdb7d2e5e0356226
SHA5127cc83665cc777a7d0dbc650d49e7a35131e85c42e6b462c38a76695ed1166e509499b0f32588d0b49f2c6c825403c417b7a1755b656d5f10b88e92ffa483c1a2
-
Filesize
12KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB