Analysis
-
max time kernel
150s -
max time network
51s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
12-06-2024 18:58
General
-
Target
a1dded515ea0cc09854ed0193105aaea_JaffaCakes118.exe
-
Size
1.2MB
-
MD5
a1dded515ea0cc09854ed0193105aaea
-
SHA1
da49ac5f84edc4fb63ba23f61c0abfbd922b0776
-
SHA256
7126b9d0de680355966b9a425760499207c227177b7addea9239b84d0f9d6d96
-
SHA512
ce554f165c554c27b79fd12801c7e1219c418c4120492def34064da04aecb4c346e94577ff8d6678d1184c2a0867e59d579b65c68efd1d7fd7c5a747aa0d2aa0
-
SSDEEP
24576:6NA3R5drXfdrDoOJxEDIijCJnQtu1h6LId7nT1RMwan3vcXB+hX:z51rDbJfijC91h6LIdzTXM7yB4
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 53 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 54 IoCs
-
Adds Run key to start application 2 TTPs 27 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 26 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a1dded515ea0cc09854ed0193105aaea_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a1dded515ea0cc09854ed0193105aaea_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\48501850\slrggadcf.pif"C:\Users\Admin\AppData\Local\Temp\48501850\slrggadcf.pif" kcvevw.dul2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\48501850\run.vbs"3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\48501850\slrggadcf.pif"C:\Users\Admin\AppData\Local\Temp\48501850\slrggadcf.pif" kcvevw.dul4⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"5⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\48501850\run.vbs"5⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\48501850\slrggadcf.pif"C:\Users\Admin\AppData\Local\Temp\48501850\slrggadcf.pif" kcvevw.dul6⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"7⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\48501850\run.vbs"7⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\48501850\slrggadcf.pif"C:\Users\Admin\AppData\Local\Temp\48501850\slrggadcf.pif" kcvevw.dul8⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"9⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\48501850\run.vbs"9⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\48501850\slrggadcf.pif"C:\Users\Admin\AppData\Local\Temp\48501850\slrggadcf.pif" kcvevw.dul10⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"11⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\48501850\run.vbs"11⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\48501850\slrggadcf.pif"C:\Users\Admin\AppData\Local\Temp\48501850\slrggadcf.pif" kcvevw.dul12⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"13⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\48501850\run.vbs"13⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\48501850\slrggadcf.pif"C:\Users\Admin\AppData\Local\Temp\48501850\slrggadcf.pif" kcvevw.dul14⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"15⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\48501850\run.vbs"15⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\48501850\slrggadcf.pif"C:\Users\Admin\AppData\Local\Temp\48501850\slrggadcf.pif" kcvevw.dul16⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"17⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\48501850\run.vbs"17⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\48501850\slrggadcf.pif"C:\Users\Admin\AppData\Local\Temp\48501850\slrggadcf.pif" kcvevw.dul18⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"19⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\48501850\run.vbs"19⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\48501850\slrggadcf.pif"C:\Users\Admin\AppData\Local\Temp\48501850\slrggadcf.pif" kcvevw.dul20⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"21⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\48501850\run.vbs"21⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\48501850\slrggadcf.pif"C:\Users\Admin\AppData\Local\Temp\48501850\slrggadcf.pif" kcvevw.dul22⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"23⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\48501850\run.vbs"23⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\48501850\slrggadcf.pif"C:\Users\Admin\AppData\Local\Temp\48501850\slrggadcf.pif" kcvevw.dul24⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"25⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\48501850\run.vbs"25⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\48501850\slrggadcf.pif"C:\Users\Admin\AppData\Local\Temp\48501850\slrggadcf.pif" kcvevw.dul26⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"27⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\48501850\run.vbs"27⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\48501850\slrggadcf.pif"C:\Users\Admin\AppData\Local\Temp\48501850\slrggadcf.pif" kcvevw.dul28⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"29⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\48501850\run.vbs"29⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\48501850\slrggadcf.pif"C:\Users\Admin\AppData\Local\Temp\48501850\slrggadcf.pif" kcvevw.dul30⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"31⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\48501850\run.vbs"31⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\48501850\slrggadcf.pif"C:\Users\Admin\AppData\Local\Temp\48501850\slrggadcf.pif" kcvevw.dul32⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"33⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\48501850\run.vbs"33⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\48501850\slrggadcf.pif"C:\Users\Admin\AppData\Local\Temp\48501850\slrggadcf.pif" kcvevw.dul34⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"35⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\48501850\run.vbs"35⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\48501850\slrggadcf.pif"C:\Users\Admin\AppData\Local\Temp\48501850\slrggadcf.pif" kcvevw.dul36⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"37⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\48501850\run.vbs"37⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\48501850\slrggadcf.pif"C:\Users\Admin\AppData\Local\Temp\48501850\slrggadcf.pif" kcvevw.dul38⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"39⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\48501850\run.vbs"39⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\48501850\slrggadcf.pif"C:\Users\Admin\AppData\Local\Temp\48501850\slrggadcf.pif" kcvevw.dul40⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"41⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\48501850\run.vbs"41⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\48501850\slrggadcf.pif"C:\Users\Admin\AppData\Local\Temp\48501850\slrggadcf.pif" kcvevw.dul42⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"43⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\48501850\run.vbs"43⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\48501850\slrggadcf.pif"C:\Users\Admin\AppData\Local\Temp\48501850\slrggadcf.pif" kcvevw.dul44⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"45⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\48501850\run.vbs"45⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\48501850\slrggadcf.pif"C:\Users\Admin\AppData\Local\Temp\48501850\slrggadcf.pif" kcvevw.dul46⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"47⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\48501850\run.vbs"47⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\48501850\slrggadcf.pif"C:\Users\Admin\AppData\Local\Temp\48501850\slrggadcf.pif" kcvevw.dul48⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"49⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\48501850\run.vbs"49⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\48501850\slrggadcf.pif"C:\Users\Admin\AppData\Local\Temp\48501850\slrggadcf.pif" kcvevw.dul50⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"51⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\48501850\run.vbs"51⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\48501850\slrggadcf.pif"C:\Users\Admin\AppData\Local\Temp\48501850\slrggadcf.pif" kcvevw.dul52⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"53⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\48501850\run.vbs"53⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\48501850\slrggadcf.pif"C:\Users\Admin\AppData\Local\Temp\48501850\slrggadcf.pif" kcvevw.dul54⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"55⤵
- Executes dropped EXE
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
263KB
MD54ae4051b656ac4a759e5f3c634d38eda
SHA1b5a22b1fe0879f15c8082620b0f001e2af586ef6
SHA25619e4af354a8e6f1661dbfdf6ce6c720bd49cf2320beba0e84d4aedbd1afcfb9e
SHA5124078cc5921213b2d43b243ff4a0a2c5fc5601a25d066602ec27d555b7db13063debebc6a8342f76eb7080b728ac826083f4111d42e65307bb814739f648c07ed
-
Filesize
92B
MD511318ab760f12a623a3f5fc0ecdcda66
SHA12c1c31aa4f672adbb523e9c561c15dd17aee784a
SHA256a59ee97faff340bb0cb551d903c7b20495419eb1b82561b85953ee14f3c9acf1
SHA5121dc0597512352bec0d86a34f3ed6b100425f01d5bf7801b71f48e56f19bae418e9f688fba1057c5eec3861cad57689e6e14dc869c4097ebf6b44e0f21ad89828
-
Filesize
732KB
MD571d8f6d5dc35517275bc38ebcc815f9f
SHA1cae4e8c730de5a01d30aabeb3e5cb2136090ed8d
SHA256fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b
SHA5124826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59
-
Filesize
44KB
MD59d352bc46709f0cb5ec974633a0c3c94
SHA11969771b2f022f9a86d77ac4d4d239becdf08d07
SHA2562c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
SHA51213c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b