Overview

overview

10

Static

static

3

3c276b2b20...18.exe

windows7-x64

10

3c276b2b20...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/07/2024, 05:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3c276b2b2004c2427d6e142d199ae815_JaffaCakes118.exe

  • Size

    152KB

  • MD5

    3c276b2b2004c2427d6e142d199ae815

  • SHA1

    66926266c9ba701884a32e9ee31702e88955829c

  • SHA256

    66928be5552e117d61769eee4ea7dbec08e0ee5e1c845ff8ef7ceaf40646a482

  • SHA512

    3706a1bca03e5dce92ddb61d220988414cc804c3cfa5563134ac83e78926b2d2c24b8241edb67bfe4aba4c5cf8faffae1f3e8b046669bca140a484d6f6dcb0a2

  • SSDEEP

    3072:fMGmPYYh0ZW+7DxNUbaxIcz93bOButK+ZAok:6+7DxVh3bHp1k

Score
10/10
evasionpersistence

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 53 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3c276b2b2004c2427d6e142d199ae815_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\3c276b2b2004c2427d6e142d199ae815_JaffaCakes118.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4264
    • C:\Users\Admin\yeoaqof.exe
      "C:\Users\Admin\yeoaqof.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:3296

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\yeoaqof.exe
    Filesize

    152KB

    MD5

    43f2dc4b1686bdbedb27b1b46a0344e4

    SHA1

    83fe2205abceebedd733a700e68ba69b93632273

    SHA256

    1d79b97e94937c310aab98f0dfbe26034807cb95414fd2c61fdd0b6395cf88bf

    SHA512

    278e8c8e798a549f46ad0fef71ab971e322ca452bb576d78f48e97f204f9ac0c5f3055c3ea8f2088aad02f870c19d1279a309f1aa7d2b02ef516a6c3e0196952

    Download Submit