Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
21/07/2024, 20:17
General
-
Target
613f632a951664ef1facb0d9a6052270_JaffaCakes118.exe
-
Size
242KB
-
MD5
613f632a951664ef1facb0d9a6052270
-
SHA1
3fd18ea2333e2812083d98966a725c9088bb8866
-
SHA256
ecd54400db0369c93e5d31946132cd3cb4e291bc58fac9b59ea86f11e028ba61
-
SHA512
2fc796437296d8b613085d38d38814d11ab8ea83887d9ed8b28817cec2ded3d788da27b3b2af1a56327e61bf29dc1dec9f6988f5c85e5e879f34d1e5ddbe89cc
-
SSDEEP
3072:FgIjJ2mbKu+aDbI3Np1KeyDJ2TFxG3sY75hsyBgc+2o:FgIjJU6yNp+4FscYH/BXo
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 2 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 4 IoCs
-
Drops file in Windows directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\613f632a951664ef1facb0d9a6052270_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\613f632a951664ef1facb0d9a6052270_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\IS158935.EXE"C:\Windows\IS158935.EXE"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Windows\system32\qoMcbbCu.dll,a3⤵
- Loads dropped DLL
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\removalfile.bat "C:\Windows\IS158935.EXE"3⤵
-
-
-
C:\Windows\MSCORELIB.EXE"C:\Windows\MSCORELIB.EXE"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
43B
MD59a7ef09167a6f4433681b94351509043
SHA1259b1375ed8e84943ca1d42646bb416325c89e12
SHA256d5739a0510d89da572eb0b0d394d4fb4dd361cd9ee0144b9b31c590df93c3be7
SHA51296b84cd88a0e4b7c1122af3ed6ce5edf0a9a4e9bf79575eadfac16b2c46f1278d57755d29f21d7c6dcb4403be24b7ac7da4837c6cc9c602342a8f2b8e54883df
-
Filesize
33KB
MD558a587cae350db3f19dfa0655b35dad4
SHA1688c306188754a3c5551d6fb8bba314c2075a812
SHA256750fa176b57dd2b94f4a58fa9fd0efbc2fa684b43415e6875211fb6fd0d79225
SHA5128a9e3166798a69b935ad9a5b91e50842accd2effd838ddd2b028b05d29b335a15d949406c4555011b05c6fdd8035366fe353c0505865cfba78a41a3757afb528
-
Filesize
188KB
MD5c419b3375ebe2f0933d18e041b81d53a
SHA19895c5dc2cf40850f1184a771a5eb39aa31d9e88
SHA256c7ef3e78d362dbdfaa47d929095cbb9b6a013662bf96521178841d611501ef2e
SHA512c601ba43aa66edccf0cd38bff2c8005b1a1935b45ee4b7b6f20ccf415910d8539dba22dd49266fc5624373ec018a14f59ebfc1dbdfd5cdecac7b1335c16f2dac
-
Filesize
25KB
MD5df933ba630cb75b186ddaf5aacfc5a11
SHA1bba7e697141d6b841d7cbe29508ed691b6779c8b
SHA256232488bd011328ddfcb5d131d64ed14832aebf8a8bb853496995efc34df5a0f4
SHA512fc3767f74bd4d9290518c8a30f41dc40f0bc88757702b3a685fac5dc637cb27328416b89e496e175e35e5aac3d999c613aba7e19e673326ec80b764d5108ecfa
-
Filesize
100KB
-
Filesize
100KB
-
Filesize
20KB
-
Filesize
8KB
-
Filesize
100KB
-
Filesize
100KB
-
Filesize
8KB
-
Filesize
96KB
-
Filesize
28KB
-
Filesize
20KB
-
Filesize
28KB
-
Filesize
268KB
-
Filesize
4KB
-
Filesize
304KB
-
Filesize
32KB
-
Filesize
624KB
-
Filesize
4.8MB
-
Filesize
664KB
-
Filesize
64KB
-
Filesize
4KB