Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
15/07/2024, 01:07
General
-
Target
4793660db5a3dc299ed73148039e8d6d_JaffaCakes118.exe
-
Size
2.5MB
-
MD5
4793660db5a3dc299ed73148039e8d6d
-
SHA1
5179950ec56b17b13530e635b4c564d3ce7a4ddf
-
SHA256
69dacc5c93020903688fdbe5896c2134459149e7b1195e9062229d2397c87f74
-
SHA512
0a49b02a1232c3822ae0ed5ac4ea18ea45b0b5670af8f59a1d1c0c11b20dd202ae0f593d39ab7e5f2c13f1b9713da622e9ace5a0283a3bdc9eb14fdb49a191ef
-
SSDEEP
49152:leAR0wj1vnVPIyyWxwChYAgsMMMMMMyXZkQsC/yje/5IqNTYlMbv/e3yCH:10wj1/fylAMMMMMMyJkQv/59Ylmo
Malware Config
Signatures
-
Modifies firewall policy service 3 TTPs 4 IoCs
-
Adds policy Run key to start application 2 TTPs 4 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 8 IoCs
-
Adds Run key to start application 2 TTPs 3 IoCs
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory 1 IoCs
-
Drops file in Windows directory 24 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 3 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4793660db5a3dc299ed73148039e8d6d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4793660db5a3dc299ed73148039e8d6d_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\servicew.exe"C:\Windows\servicew.exe"2⤵
- Modifies firewall policy service
- Adds policy Run key to start application
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\woron_scan_1.09_eng.exe"C:\Windows\woron_scan_1.09_eng.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
3Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
3Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
454KB
MD5fb65cda7f047cb664bdcb2d46d1d928e
SHA1794a4067ecec4735bcc16fd6d7bd89512dafdaaf
SHA256c3b2ee29ad1f3aa321dd74d7a86f74ef1ea3184bd26918577e59c85743f73e6c
SHA51204bbeed279d5fd721599c341d3d22b71d5b7704103d8b325433d2638f40a068a41d02b99e1467e9257cc27450b77aaf8d622e0d03a149ff054d37ef8094c0355
-
Filesize
459KB
MD5aa5591317e4420ee2186efcdef613f6a
SHA151f79f9976e2764cf5ff641eb976362f29b4b6b6
SHA2567e0cdf0544ac4141cb788903f07971b5c1c0b117acd4927a6fd83898fda46293
SHA51268f596fec2adaf5f2cc40d57ca958ff6a10d7c81c71dd74f384b5278c5981d8159e9ece5b6755e01f8ab6876059b7dbe1edb51bec54c41b8ab738e6d03276eee
-
Filesize
808KB
MD59756447ab80b3d6db2f0f6e168232d29
SHA1bfa6adecaa8b133db80a6238fe3fc20274480fcd
SHA25625931ddae08578c295351447e2910f921fa8c4b453f3e28cbf26d9a4fda68b88
SHA512b431f6a537a003195943d27e8f7a7f70d7e31cd9af800cd263675edce6581319db61bb6bf601ad817b40408511b3f62143d8d34664a39285ccdbbe7d31a2bc81
-
Filesize
18KB
MD5edeacd1131cb575738ec4b8f8cce235c
SHA136776ca265ec5b165315644ada4c66fa9d97957f
SHA256b793126ba3949e854bc54288c881d0519da6a7edaa5c21f65709eabb3d9e8da1
SHA5128562e00b44896b30675561e2a3a50ac454f86f0b1a37b09009fa509f1e591d8022c86df82033c48d79d5c28baaffa219330e44534b83bdd1549973b0ada42aac
-
Filesize
680KB
MD52046a98801ad81cc1c261bfe7d0f1ddf
SHA199c9959612e10befb4f2e0feb26f6a337e274996
SHA256527595358c5c550b1c7e74a662634befbddb5e70e4761c414c070f7a16351bc0
SHA51291a87308c7a350dcf4f092eac100444febc1c77912f1bdbb61aab601f647644fa01a52717f268973f8deb001be5940842fd73494fdc86e9700128ccf8602d64a
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
488KB
-
Filesize
476KB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
476KB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
4KB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
476KB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
116KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
476KB
-
Filesize
476KB