Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/07/2024, 08:16

General

  • Target

    27dd7cd599665b1e3ea406fad3518bb7_JaffaCakes118.exe

  • Size

    148KB

  • MD5

    27dd7cd599665b1e3ea406fad3518bb7

  • SHA1

    28e8aee41272c171b45abecebbe93fca67c24fce

  • SHA256

    74e080f0f98e8c250774bb30d4978ac50188502895d420c022fd03f53f29f88a

  • SHA512

    19a512367fc935518e757ed3501e95c82fac7a715da9961c66201088785970135a75f3cd6ebcf4bae57faa8d0f6d9b2905aa11a5ee07d9feb186e3bb056daa1f

  • SSDEEP

    3072:gG5BVnzPVigj6G7gW1lktdViKPkKE9qKIu5pE5j4oQjQ:bBVz9Fj7b1eyvXIvdgQ

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 52 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\27dd7cd599665b1e3ea406fad3518bb7_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\27dd7cd599665b1e3ea406fad3518bb7_JaffaCakes118.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2164
    • C:\Users\Admin\ltjoag.exe
      "C:\Users\Admin\ltjoag.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:4208

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\ltjoag.exe

    Filesize

    148KB

    MD5

    30c61f77e2597d10028423252ec983e8

    SHA1

    6856cc358c7ea8581303b2b8be5db1d00cbfd57a

    SHA256

    ddc827a655c4a24387a0a1e7434fcc1f55179a6ac6c0e728a184095b53d9cfdc

    SHA512

    5f4501f856a15781f28c22914d2dd9ce6708936469329ca0cfbf54b49c92c21e2021791c13e041ad7603877b5149ece56debd4b1f5196475f986aaf5d8d2ae94