Analysis

  • max time kernel
    129s
  • max time network
    100s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-06-2024 02:29

General

  • Target

    18760eae1da56df4e02c96e6a00781b6_JaffaCakes118.exe

  • Size

    596KB

  • MD5

    18760eae1da56df4e02c96e6a00781b6

  • SHA1

    e7baea61816c90f8047edc46f9b591e0f28cfdbd

  • SHA256

    86481521ec3a1fe780a6dab70518eff29453017674a6c34b606822220d52fa0a

  • SHA512

    404379e1a60f3357eabf3603dcea25ac2ba2ac0012726e3ee9283afd2bdb9c1e6f2b870be2595eff9f4252f4ed59dfa8930131646efe2c324dd356409dcef637

  • SSDEEP

    12288:LLaqQBLPSHeiB9Ea9yb1hHrDYJ5YBGwCbRfB8dCFD:aPPSFgaefYJ5NoCF

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\18760eae1da56df4e02c96e6a00781b6_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\18760eae1da56df4e02c96e6a00781b6_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3920
    • C:\ProgramData\wXicueBkvBxJao\wXicueBkvBxJao\1.0.1.0\cYNhXOcmVV.exe
      "C:\ProgramData\wXicueBkvBxJao\wXicueBkvBxJao\1.0.1.0\cYNhXOcmVV.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      PID:896

Network

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\wXicueBkvBxJao\wXicueBkvBxJao\1.0.1.0\cYNhXOcmVV.exe
    Filesize

    428KB

    MD5

    7816803684cedaf35af65d77c32bc01d

    SHA1

    35916478563566c33d257b518eeb33df174c5d6e

    SHA256

    51112b7779aebab85338ec70aaea769dc0a609ee16609a4fdb7fc9e97de085a3

    SHA512

    c3199066ee8fc9b0fc44c8a66aa19bea35ae47af7c436175f04152026597159efcb3d9ab5a7275ae499c8d341b5890f26cb2e8c98d8a183735523a5e8cb33d75

  • C:\ProgramData\wXicueBkvBxJao\wXicueBkvBxJao\1.0.1.0\kernel32.dll
    Filesize

    18KB

    MD5

    e4b4f52d91c49da13fc81a654763bb61

    SHA1

    75b42b5236cbe8ff240a98f3553b17dc4a8ad7cb

    SHA256

    45b2457fc46410edd11de51437e2561a661d37ebf2c3790db31876ad064be0d1

    SHA512

    bcbb042be2ee1d848525e10784b473702a06d7818ad1acfd77cd624bf0750f9aa2d8d172bfe3a916b33561e20ce69a07009f23fbfffb509a54014cd2a58bd288

  • memory/896-16-0x00000000746C0000-0x0000000074C71000-memory.dmp
    Filesize

    5.7MB

  • memory/896-37-0x00000000746C0000-0x0000000074C71000-memory.dmp
    Filesize

    5.7MB

  • memory/3920-0-0x00000000746C2000-0x00000000746C3000-memory.dmp
    Filesize

    4KB

  • memory/3920-1-0x00000000746C0000-0x0000000074C71000-memory.dmp
    Filesize

    5.7MB

  • memory/3920-2-0x00000000746C0000-0x0000000074C71000-memory.dmp
    Filesize

    5.7MB

  • memory/3920-17-0x00000000746C0000-0x0000000074C71000-memory.dmp
    Filesize

    5.7MB