Analysis
-
max time kernel
141s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
15-07-2024 05:25
General
-
Target
4866fc7e9ec5e1527931e54a98116a1c_JaffaCakes118.exe
-
Size
371KB
-
MD5
4866fc7e9ec5e1527931e54a98116a1c
-
SHA1
8f69166896157380565d7beea5bf6061e2ceb043
-
SHA256
ab1849e3e1d1d6a4573a2812ac764dad1e3f35ca9b9cb4ee10703305fff3d523
-
SHA512
19c1782e7438834e86ac2db68178a7fcd9b16f1ee33dfd717613624199a844c4a06bc34bc18aeeeb6f89a2e6c9c88536cc312c0b4dbcc6a77020d5e92575c743
-
SSDEEP
6144:nCuOCgRcak24bbOHAtBccV4CB8j7UIGMNx2D1lOLW+9qLycc1FcuajxJ:CuOCHak24Wgmc8j7Usv2Xx+9q+D1F+jL
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Checks for any installed AV software in registry 1 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4866fc7e9ec5e1527931e54a98116a1c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4866fc7e9ec5e1527931e54a98116a1c_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Checks for any installed AV software in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill.exe /F /IM MSASCui* /IM avg* /IM ash* /IM McSA* /IM msse*2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
52KB
-
Filesize
552KB
-
Filesize
552KB
-
Filesize
552KB
-
Filesize
552KB
-
Filesize
552KB