Analysis

  • max time kernel
    150s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/07/2024, 12:56

General

  • Target

    22717cc0b6402c4a345a6cf5c9584577_JaffaCakes118.exe

  • Size

    332KB

  • MD5

    22717cc0b6402c4a345a6cf5c9584577

  • SHA1

    833181edf6baddc67f1801b3bf382cfb9305cbac

  • SHA256

    daa756b47afacdcfcf939a297091d391f95e5bc7634eb65b34d2ddfda4f2024c

  • SHA512

    1526ac96803de32304e46bc7efe24e9f142d8b28bd36f85d98ad2f7f0ffce4dd852519bbceefebad70231e11dc06cc0f4b3b47a2ffc768c30122048deb7e754d

  • SSDEEP

    6144:XTYpYGCleWHLNAnJHms8aBDR12SgqDxJd:XEdNnFV12VqD

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 53 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\22717cc0b6402c4a345a6cf5c9584577_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\22717cc0b6402c4a345a6cf5c9584577_JaffaCakes118.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5816
    • C:\Users\Admin\cbpaur.exe
      "C:\Users\Admin\cbpaur.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:3284

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\cbpaur.exe

    Filesize

    332KB

    MD5

    1886ad2dc87dd73afe47cc8b5dbce7bc

    SHA1

    a71c860f78b850f7453a09ac6f2d4e5f24c2dee8

    SHA256

    655b82986d492e6bd5d5dbbd097f1c73e122b7cad8c4be207d34d631928d9dc9

    SHA512

    30341eb1d43cca11a5d4ed05ec3909e11bc7faa83fa66e051cdf701eab1a104d414f5e1c6e652bf1935081037fca5cb4aed3bf66f08867b8739e78d132b09de1