Analysis
-
max time kernel
149s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
14/07/2024, 13:50
General
-
Target
4617d351571b290dd2ac18f5a9cb01e1_JaffaCakes118.exe
-
Size
2.0MB
-
MD5
4617d351571b290dd2ac18f5a9cb01e1
-
SHA1
d8f8b8512c8293fbc46d570da50959c43fb67ee4
-
SHA256
545e23521013ade9bf24bcf2309568ad1d40689c000c583cdd6f2f2a2b224330
-
SHA512
d5054893ea648b8e11372ff52208c06e136b8dd166499c5fe9a96fb1a56107b1466c47af6700f5f30fbed5ef52b719b452d351c52a617b87da857f803145a42f
-
SSDEEP
49152:Ek8z91KUD9yUNmHPHATQrskjwB4U7IOa12:EH91LD99NymQQkjiT
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Drops desktop.ini file(s) 2 IoCs
-
Drops file in Windows directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 8 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\4617d351571b290dd2ac18f5a9cb01e1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4617d351571b290dd2ac18f5a9cb01e1_JaffaCakes118.exe"2⤵
- Checks computer location settings
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\server.exe"C:\Users\Admin\AppData\Local\Temp\server.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
-
C:\Users\Admin\AppData\Local\Temp\Cerberus.exe"C:\Users\Admin\AppData\Local\Temp\Cerberus.exe"3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
MD5631d76eca045026b55b9691973cac951
SHA14ff8dfc278992e3432663e08f83cc0796c282438
SHA256883dade7bcba92cb437f9a0acf62f3491c6a6637b0255eb84adc9813601e7572
SHA5123ac4bf1083ac68f9ae769843476decc949fbf827a63adb1cdff46b6908d9dfcd74462c640b58a099f1ab620425e432d72a8d55490abbcaf937f1191bf5cdf866
-
Filesize
20KB
MD5f2764e646669472a50d34848623303be
SHA1d546a7980029656b2a9c343cf65d9bfbdcbef9a5
SHA2568f2cbdb3c23d6072b31dffcb7ad71f0abc37932c9188dc01e5b3a0973f74e6e1
SHA51227c31f0ee8152c3be2dfb9b847fe848d7f87218d214bfc02249305f6089c39b819afa31aac90b91dfcf010dce88866f637eb322c5e359178671cc058a4e1182a
-
Filesize
2KB
MD5e78bf2ad1240307b13934fea4f01007d
SHA1a494c83dc71555403f16b6fcd9270cbc2e502445
SHA256a4090757cca167cf5333ec231234a773279e69e7c0f57ce9c5f88575e4126602
SHA5125a365f12aaea0d4a165d084c5a14ab2248c8beb4433bd5e7b1f11436e20a647172409f522e775f202bd9b2d35995633fd41c62fb24ed881ed9be90857df9ec00
-
Filesize
56KB
MD5a2bfaf4ccb6d00671933a423595fc9be
SHA1f264ce9388521764bf8911b8bb4c7ff9a08bc8e8
SHA2561e6800ad5f5592af6bbe63a4f72f45ca73422324c2f915feb0ab69b5d0f5cff1
SHA512a342ee6797b3d97761c1d11dd25991ceb28235a32c6aea2ede1c9f5d3f59feb1a8396865341ea1236f982425e4a040c6185a43ef49b124551db5cb05bae33d8c
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
4.3MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
4.3MB
-
Filesize
6.1MB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
80KB
-
Filesize
9.6MB
-
Filesize
664KB
-
Filesize
4.8MB
-
Filesize
48KB
-
Filesize
624KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
4KB
-
Filesize
9.6MB
-
Filesize
304KB
-
Filesize
32KB
-
Filesize
36KB
-
Filesize
36KB