Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
21/02/2025, 17:58
General
-
Target
JaffaCakes118_144d46d31aaaa265bbb9f4e39b8a192e.exe
-
Size
15KB
-
MD5
144d46d31aaaa265bbb9f4e39b8a192e
-
SHA1
bf0fe263d8b8d0720c788ab4436963d0abbe10db
-
SHA256
6936f3b7338e3504564e1f7f64d883774d92b44a9cb775855cd370f1e6fd2bbb
-
SHA512
5a7f608b56bc748d12cd9630a25cce27434c6b365e194a6e71c26d51e04c78942237dfe719ad835854683e6a1a8765b6a860c943fb3b4171743845b9f04fd120
-
SSDEEP
384:q06KR0Mk9XOU3+RqDYkWTMLYn2Kz/SdmIyx:q06f6C6oYbjn2wSy
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 7 IoCs
-
Drops file in System32 directory 4 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_144d46d31aaaa265bbb9f4e39b8a192e.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_144d46d31aaaa265bbb9f4e39b8a192e.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\gth79338.exeC:\Windows\system32\gth79338.exe C:\Windows\fOntS\ComRes.dll ins C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_144d46d31aaaa265bbb9f4e39b8a192e.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
156KB
MD5615d4a31846add4208fc9e861e615954
SHA180d5324d7d1aacf800efd008b2f23d59531ff5e3
SHA256097747eb5f1ccd26f2702c00f203e8c34bd9f7b914edcc02ccabf4538e8aaf07
SHA5129648c3b0c82295ed2a6db8c2562e24b9f52c4861e0df76273b8fa93581d9d5c2a189a0a73ab7209bb039c489ec0b9274b0833b7f5d57a859bc69656c0a4966c4
-
Filesize
1KB
MD5e316712fd7ac49dd852f968de547522d
SHA1aa60c1481e206f0d7543d39ef9fc015646e2195e
SHA256125138be41d0344979bcd7a005bb0103673364c3610814b4082834c7ae004f76
SHA512c8c36e2d09b15c0c442cfa74100b5f80e47f30127a60743c2e5d8199a02dd32ae4a3ad5935a4577b16d679799969c89311d987b60cab33d6f5cf3ff45f57bf79
-
Filesize
31KB
MD54873afbc7375a7f8b3cd08871ec58c87
SHA1415a419748f9796bcee8958ce53b8ab18da791a4
SHA256eac772b4291ba5a067a3b4307d5d303e1f4bc9d7d564661eee348b0ef8c4845d
SHA512446fdd3ad7039e3063b2a4152e55404a4c4653b6b7d09b97f9375e89ef2fadcb2c58769102559e009c7d7a405af857acd0e169bf50fd534076b3e82452a93d8f
-
Filesize
43KB
MD551138beea3e2c21ec44d0932c71762a8
SHA18939cf35447b22dd2c6e6f443446acc1bf986d58
SHA2565ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124
SHA512794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d
-
Filesize
40KB
MD584799328d87b3091a3bdd251e1ad31f9
SHA164dbbe8210049f4d762de22525a7fe4313bf99d0
SHA256f85521215924388830dbb13580688db70b46af4c7d82d549d09086438f8d237b
SHA5120a9401c9c687f0edca01258c7920596408934caa21e5392dbaefc222c5c021255a40ec7c114a805cdb7f5a6153ec9fa9592edcc9e45406ce5612aa4e3da6a2c4
-
Filesize
224KB
-
Filesize
224KB
-
Filesize
88KB
-
Filesize
88KB
-
Filesize
56KB
-
Filesize
88KB