Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/04/2024, 12:58

General

  • Target

    f5d274a7491191e1a0180ec06a70c7bb_JaffaCakes118.exe

  • Size

    216KB

  • MD5

    f5d274a7491191e1a0180ec06a70c7bb

  • SHA1

    d675406a2e63ba4b7a87e72024e575e0453f6324

  • SHA256

    96e73eb087f1c27a05ad2fbd861b9fd4c73bd86dfda4215cf4344bd3d934d181

  • SHA512

    f71f59e49d7a6c81aa0571d78432f97c35844872eb3c2c4cd89d4137b266d789d377f27c5c215c7bbc6fb2a416aebfb9e63f414c6acb2f924ce33c1ca3081610

  • SSDEEP

    6144:CcX2DECtrkQ5zgMZUP15HcAgonAmKfwDVAQ:n41gMZUHcAgonAmZDV

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 52 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f5d274a7491191e1a0180ec06a70c7bb_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f5d274a7491191e1a0180ec06a70c7bb_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:232
    • C:\Users\Admin\booutes.exe
      "C:\Users\Admin\booutes.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:2464

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\booutes.exe

    Filesize

    216KB

    MD5

    b2ccb09781acd9170862577f178d1cdc

    SHA1

    523474b8cbf6a55a04d2dbdb0356da9e3895b14d

    SHA256

    9fc61568ee7dd3dee6462ebeccf66507b402c3a7b43906d6c5fbc8d4c6b99715

    SHA512

    b7d46761f433e7cb2d84f537152b092b65d67171c2727df7c870cef826bd667cc0a551629c8a09a8779d4ddb5abd2e44f14bf57729f4e710e89d2193a47f947f