Analysis

  • max time kernel
    149s
  • max time network
    123s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/06/2024, 19:24

General

  • Target

    0a66045d67cdb7b6ffab08a99ceae1c1_JaffaCakes118.exe

  • Size

    204KB

  • MD5

    0a66045d67cdb7b6ffab08a99ceae1c1

  • SHA1

    9d7ed36c03fea57d285bf98f5d65455edb4abab8

  • SHA256

    69071c98e85177050f31e1402b736bfd4809982027cba562569e97df0aaa035f

  • SHA512

    60aaa8d8845ab2053c5967a61a451251cc4f6ff5a761e3a741e216c2372347327a9779903ac6ea7df0034618751af01c1178c0e8837d41c9c0f3420dcbdbd893

  • SSDEEP

    1536:CdvLk30zZ3NMsOfXu7Ke9TG4yMSmcUk6lCbQvmSTpJwuqCNQR6nkX5SADkPY+GdK:q430ZTTG4yMZc9pJSTp63ZGz

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 52 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0a66045d67cdb7b6ffab08a99ceae1c1_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0a66045d67cdb7b6ffab08a99ceae1c1_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:372
    • C:\Users\Admin\hwkuf.exe
      "C:\Users\Admin\hwkuf.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1956

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\hwkuf.exe

    Filesize

    204KB

    MD5

    84253d2557b1742a0f96900aeb45cbfd

    SHA1

    094d80aa8e82efa5f0c2b9a62e745a188283603b

    SHA256

    09db719efbef03c87d607d3f88a84aadb6a3211dd9565219e8e6737baee3615c

    SHA512

    42f7967ba1d32a5afc131e56e345cfc5d8b0c560c24225395e3182c6dd2d28b837da910507c348ac592b95a49d2ac7fcf894f5de3ade66014eace732a7ca2100