Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
20-04-2024 20:37
General
-
Target
fd98e0c2a8558c0a96ef150eb111c45e_JaffaCakes118.exe
-
Size
1.0MB
-
MD5
fd98e0c2a8558c0a96ef150eb111c45e
-
SHA1
6d803347797695be2f83000e4b363d30ae8d2aa9
-
SHA256
2e5f7852f8c8fe9f8bfb227a213c5ae9be86a53987866a37c66fcc83046a3e92
-
SHA512
7efa3783333e3da291b6eee4f1eedc21a2752b6ee7f8fc72a99ccad2414fbadca30e7162fc9c48b988cb66aec81ad29c0bf4cf484edc1bde8a808c24327ecb0c
-
SSDEEP
12288:KZb+woHUIZI+DkVurXnnW2aLkEgB1BqKSKXxDL6nF/8ixtBQ4Tdu3qHFVJJmVxS9:wTIZ9RznnWuEgfIO8xC3egSY8
Malware Config
Signatures
-
Modifies Windows Firewall 2 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 55 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fd98e0c2a8558c0a96ef150eb111c45e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fd98e0c2a8558c0a96ef150eb111c45e_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\LocalJFiRTpkrdv.exe"C:\Users\Admin\AppData\LocalJFiRTpkrdv.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\LocalJFiRTpkrdv.exe" "LocalJFiRTpkrdv.exe" ENABLE3⤵
- Modifies Windows Firewall
-
C:\Users\Admin\AppData\LocaldOwXcLcKGH..exe"C:\Users\Admin\AppData\LocaldOwXcLcKGH..exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1Pre-OS Boot
1Bootkit
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
99KB
MD5121ffbd73501445f6d92bd8926c601d0
SHA1f286e21fdabb2df748591d4339d815c13f60ffd0
SHA25651357a4e625b3c94fe6047f3c5152efd1cbd4d9e8530e3ce14c54984ceb95561
SHA512368a30e330a364b653e8acf0feadd6f50ea757f872d0e85bde280e23e2ad4ebf9f604c8df2e679c8aa971135abac090490f3efee03dbe312531e0f1976f2464d
-
Filesize
74KB
MD52814acbd607ba47bdbcdf6ac3076ee95
SHA150ab892071bed2bb2365ca1d4bf5594e71c6b13b
SHA2565904a7e4d97eeac939662c3638a0e145f64ff3dd0198f895c4bf0337595c6a67
SHA51234c73014ffc8d38d6dd29f4f84c8f4f9ea971bc131f665f65b277f453504d5efc2d483a792cdea610c5e0544bf3997b132dcdbe37224912c5234c15cdb89d498
-
Filesize
1.5MB
MD5ab22f6d86627ff7cd3ecb8bad27fa041
SHA1f020d4c5aa9778d97dd20e7d3a486951c7f4e0af
SHA256e4ad01ce4e61a35a3a5bfd8161a629d3a77c25b78257a79e2cf8656084f9e8c1
SHA5121501aa4f2ff3417a7e7ecb721163c43f720e1f785bea0d673028ac20a86009c7fa89f38530cfad26d556b37de3f291cef753ce472f961ed4696771d07fef493c
-
Filesize
152KB
-
Filesize
624KB
-
Filesize
664KB
-
Filesize
64KB
-
Filesize
4.8MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
9.6MB
-
Filesize
56KB
-
Filesize
64KB
-
Filesize
9.6MB
-
Filesize
1.7MB
-
Filesize
9.6MB
-
Filesize
9.6MB