Analysis

  • max time kernel
    152s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/04/2024, 17:50

General

  • Target

    bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe

  • Size

    72KB

  • MD5

    bec83a08a91042c1b2821e5e017a7454

  • SHA1

    29f14719377327016caba6f7d660271c307db76e

  • SHA256

    8c5d1e372be183f79a1e791b42c234e7abd1b4f83616803633e60a0db12366fd

  • SHA512

    139e9817df218756ed8d1dd324f2295949ab19c0927fa3fc60825809775f9c07ce706dc696644c2459f1409d1579718e5f44b8dc45415c59b5c4c74fa3df90d0

  • SSDEEP

    768:j+MPow1owYOWJOaoEty+6YPNEOAdnupNqFNcXfLgA86W5LcbujXwbQ9eptlR3qEC:1Aw1owcVfd44rDHEmNfP8Sv+QA

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1668
    • C:\Users\Admin\woudu.exe
      "C:\Users\Admin\woudu.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2840
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4104 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:1004

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\woudu.exe

            Filesize

            72KB

            MD5

            5d2579377d7a2259e175c9a1bda5a56e

            SHA1

            55f44e09257b79d5a7a3bfe8a97868b2dcf332c4

            SHA256

            c678c534577c83171f7ed75a3a5d431b93c93278bb563e003708e25713a65e3a

            SHA512

            f5dcd6351ec22b4f4171b36def1351c07436f5eb514d991615b2e97de1b6f94ec502cbaf985d00b656cab88cb3db85d04960002e38044264aef5174e32fcecff