Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
23-05-2024 02:12
General
-
Target
696869f33a53d9bce7d99b783c81b013_JaffaCakes118.exe
-
Size
555KB
-
MD5
696869f33a53d9bce7d99b783c81b013
-
SHA1
a5d730bf9de655b5fd5e52fb722f80c159df240d
-
SHA256
1302f341df64b65b1e9f3b1ec92ad1b980562cc803943ed52070e98289b649d6
-
SHA512
aba70ecfd095a1d5101dd905c02c8a06a6d53031b3e5d0801a94b9b47ed957e9a5263d5dea09039684f1bf16163cf1f757717d605b22090a869cd6e8e9d956f9
-
SSDEEP
12288:jJfn9d2yFOpE0LCihZgqQZH6l2WiKhp68:dfn9d2yME0+izgNZHiikp68
Malware Config
Signatures
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\696869f33a53d9bce7d99b783c81b013_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\696869f33a53d9bce7d99b783c81b013_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ggs5340.exeC:\Users\Admin\AppData\Local\Temp\ggs5340.exe /VERYSILENT2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-51E7I.tmp\ggs5340.tmp"C:\Users\Admin\AppData\Local\Temp\is-51E7I.tmp\ggs5340.tmp" /SL5="$701C4,118715570,114176,C:\Users\Admin\AppData\Local\Temp\ggs5340.exe" /VERYSILENT3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /im qgna.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /im gamenet.ui.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\QGNA\qgna.exe"C:\Program Files (x86)\QGNA\qgna.exe" /uri:gamenet://startservice/3000120100000000004⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
183B
MD55771f7f102a08023b5595fe5f9013822
SHA1faedc28c00fc7471bd98cd4b58ddc7b0965b8c79
SHA2567c1b5c75bbec2858b3d1e7d19a3710dfb38b689a42349ac98a74ada53107bf37
SHA5126ccd6f7a8ffc94ffa5a5501adf8a828c561e51e98f43fc6a25dcf19fc6dbe4de9418450f3e36df0792f450be75fc6dcc8dc492685723017d5c0c0861f8a43207
-
Filesize
108B
MD5c4c725653dcd2047c14c170e8689c955
SHA1d00a1ae630ab11acb3028950be861f964437b1ab
SHA256439879baa7252256ae8dd6a5c6e81af06489f610bf6fd86b935a4579cfd35334
SHA512db72a64ee537047bca42e7b6755fa390e4782c2bd8a7b1dcab6b6f00d7ff3bb0fb1e90aa9dbc0474ab42eaa441801064c8709fcb1b2ce698d614f6e97779bc10
-
Filesize
754B
MD5d85f0935185c1cee29b3ed0f3ac31134
SHA1efcc6c18d0fa851aa8d6eb9fae979a8a28439b56
SHA256848f4e59025e9ef32e30f93b67ae40c6ad084eb566d1b1c368f0dd824c7cdf24
SHA512eceef0b196495f81f3b949bd9b63e792c743ac561804bb151887fc13ff31549f78caf4c9df89e6a01e8b56db36d078cb64c5cb3b865bdf0f6e8dbfe247bb1394
-
Filesize
217KB
MD5045c2ba3f7e998a620cf1a1dc67ee58a
SHA1b6a3c84ce92243644111024d9cd1137c2267f60a
SHA25623e067fda96566afeaf1979f46dec10b2a5839e120f096d63beab7e4184f4fc3
SHA512897303d43dad2c1a221043e34a5a95737c3f35f1506416688c378af2e00f5dbfa7ee0b21575ce008f6c18c39473b99373ed289327cff531631c5b5c4fabb4983
-
Filesize
704KB
MD500f150ed5667c4fb6ccea82da3a39a98
SHA19e1a371489c18a41a316316b00d9638d8697506b
SHA2569a1465026bf67f991313d1eff9cdcdd6e7b6f1828a80d20b33ed5dfebe1d5ecc
SHA512dc11e1bd19c8023ec068311b917cfb732d6d3454b59f435a6f91d62dc5f86189a6cc6c260be153ba6a8810fbc791ea38795c0530c4b5792d6ce213d4757790d3
-
Filesize
256KB
MD5580d27378167af6b4150d7057b9416a0
SHA1ccc53e3f66aea1f6076088f39a53bfe3d50200f9
SHA2565758c3c6e43d993753f48c7aeb3180cce7767582c885340532e8b354d9ec9ade
SHA512fad51668891106cc9bb7cb11545c30f535e8514154b3c6b2e1f23edbc69ce38a8a238ed1d8b3dad2be265111916d17d7286223c4bfdc223761b77e057c827cf0
-
Filesize
2.6MB
MD5fcc03c6f6cef5dd248ad4bec8930c589
SHA165b3d689d4af0f819e0a45763369e7002f01d095
SHA256ff729f904f1f6324ac4ea096b075a6d9c2551824d19e663e5d055402e821f282
SHA512809bb7772d238e333d3faec781014c3bda097d8e8a13d4992ed1b242ce88b3e4e5062f9d6505cdf9be1dae1ac9b5c80e4419797fdb3803697d295bb8c2e3db7b
-
Filesize
832KB
MD5fcce4db43a434530422d3a3325a2a9fc
SHA1992db37abff36da78aa44324d7ecf1c9c582f8af
SHA25656152667089eac7780f9ad6416b1ff728550e392153008997ed63c7a5875e218
SHA512d4b7b0899332401c60c90f1b9570ce472dc8232fb84d0edb482eed978426ab6efef81139130710b9c4354fc0b36a81566ee92658ce2a22f97484a5b493dd3439
-
Filesize
2KB
MD5a39c40a3dd643ce480661e104af6b75d
SHA1a75411cb1ba4a5d20ba69570bd83d16138387a2b
SHA2568a323bcf099260925034a40ba80c72ce2155c87ff30f7884550d736030ff0c35
SHA512748d55c0840afcf320089f48e63bde9202e068a321db2d27f68184abfb7d0b21b5008d833d0fdd0c344a7d6eadd79705a469977a6174c28c4dfe36039e6e9575
-
Filesize
2KB
MD56e83d2a765da2020a2b16897636db4d3
SHA17cd0b5ac12489aa7bc417653b9b8bf014d78b10c
SHA256ceae68748720d99b8ce88c3a6da3c97042393b54723c35ee729c92cb09c556c6
SHA5122ca6adb46223ed59e6ec4bc1af92235a730ec08e7af996cc733ebd0bf4f9173af5c97b7d20f3079f2dd20a52f99faa1a2873ad45ed7773743c4b1054185fe5e8
-
Filesize
1KB
MD55428239b32fe088814ad9a846a790425
SHA10f3b49cc45351a0b85bdc0ae683f9cddec3034bd
SHA256927e1bf7855105e6eaf04da021d6b1cb8e2835f0a5ce0a5353b7a89b59f97ba5
SHA5127cd726af5ae48838497a51d6d4f41467c1427127f8be24aa9ef947d612202197886809284591965c28d4bb207525a763f6bfc3452990bb8725f183f2a703425f
-
Filesize
450B
MD5f58f8df36b858c5eb418df781e210b67
SHA1ccb5369142ceab6f8bd9189fe3a10da830f8ff6d
SHA2560055003f71bf38963bedaa016ed4cf15e16e2d3f69ef2963b674e3fb7896a829
SHA5123299ba66fa819e2a3e9b8f3bad6283bd336ce57fba9fd3e987df0814cc4a468a550792f0f325b2a77fbbef1ba9b5870922d128be98fa8a245bb2f111c3d2c1bc
-
Filesize
474B
MD58fb17304e5d6eb4c42e4ba075b873784
SHA1999665a8d5ae203f8dc04fc8e68e05187e5dc113
SHA2567a757c5e684e6c58692ae4ec9be88acc4c689c62b5290583ff491e9d90869c25
SHA51247abb6891be3b7e04c09319a7d8af75580975c085ce6a4c013a77f2e9e2d6086874d814b28d318fc8e5f1ea2c2a96d29bd2df6d4ba064741b382a2acdab6a461
-
Filesize
458B
MD59b02177055d23c12816800e4042bb954
SHA1d4b06b7711fbb10fae8360e6d5864287f896acca
SHA2562827742dc53601cf7a19f28bcefe3ef6b28a620f8166525cae999339efaaaddb
SHA51253ea6fc10025602f0fe650f369521905593742438cf251a9ab6b4b37280a0c5bfad156cdcd4a2fc6fc822e8f727a913214082d9185af83abcdb0de01a4733df1
-
Filesize
187KB
MD59e6db51ef2d2a6035cdbdf7975ffee3c
SHA16e0b9a60236c5cd3d315ed4c7710d7e1b00b24a5
SHA25617017c4146999121cb1f882a9b4b8ec49161f698f3cd989653095a1fa0480729
SHA512ff25f7548002ce9132f1e55fff03d9c02ee2c4727c3d43c52d23063c6cd850d6c17a304c885b70c3d523cddd86b4b543198551d6125a37c82934fa657846a891
-
Filesize
1.1MB
MD5f120c361b527a9d090782300aa8f1ce5
SHA1ed82441da0dc7a5695ef96839fc2aea0f0c7e376
SHA2569209a83ac4b0127081327b6e03960e2a4325dbb31f0bba2b56dfb785583f9825
SHA51260fc418c4296f67b923e1fff4e6034ed41eeba61604b14d560cfd84e7476b59311c6029aee7ee602d8fdc635107855e5c05dcf6a0137c6ba89db7134e63e5555
-
Filesize
1.5MB
-
Filesize
3.9MB
-
Filesize
660KB
-
Filesize
304KB
-
Filesize
148KB
-
Filesize
148KB
-
Filesize
60KB
-
Filesize
1.2MB
-
Filesize
1.2MB