Analysis
-
max time kernel
67s -
max time network
51s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
-
submitted
27-04-2024 22:30
General
-
Target
03c5657911edeb3b44ef2474f2d6c58b_JaffaCakes118.exe
-
Size
277KB
-
MD5
03c5657911edeb3b44ef2474f2d6c58b
-
SHA1
a4f94422723b2b33477fd6961544088c481ed327
-
SHA256
70f6978a4c00b25f4e1ee28215c868cb560fbd65ce102c3d48c0a3fcc1987a16
-
SHA512
9dccd1d696683929743ff813d612cb480b4614aba083e1be80405fa1eb372fa8cb24b13fd4702cc3e2cf316c2dd44f1b033c93f3b38e6bfb922c12e54ae9c319
-
SSDEEP
6144:8LaARS0LBZmht0eQMlvNjwD4CAVvmEYX303EHweC78DjVsxd:8mAU0LrK6Mlvp6MUn0Des8DxQd
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Drops desktop.ini file(s) 2 IoCs
-
Drops file in Windows directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\03c5657911edeb3b44ef2474f2d6c58b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\03c5657911edeb3b44ef2474f2d6c58b_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\n2683\ins2683.exe"C:\Users\Admin\AppData\Local\Temp\n2683\ins2683.exe" ins.exe /e11736361 /u51938065-e47c-4b97-bfda-2a105bc06f2f2⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
265KB
MD54c24a9e76a700931ae23e212519593c3
SHA1d738435c7d5d98223462e6b4dd97e1081f911e97
SHA25675912abe46cabda79f285ba2b0d70c8aa31eae564886d2f483f3e325379b67fb
SHA512d48038bdd5e06761c45b711cf7dff1c5b6e56e5cbc230041fb16e1f3418235809008ea3545375e02b48b0cca1857348ea23fd4fd35165e72df9a9956b225f12f
-
Filesize
548KB
-
Filesize
548KB
-
Filesize
548KB
-
Filesize
392KB
-
Filesize
40KB
-
Filesize
9.6MB
-
Filesize
624KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
9.6MB
-
Filesize
4.8MB
-
Filesize
9.6MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1024KB
-
Filesize
5.1MB
-
Filesize
1024KB
-
Filesize
9.6MB
-
Filesize
64KB