Analysis

  • max time kernel
    149s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-07-2024 05:05

General

  • Target

    77227411ed5a56e7f8caaaefb8551b11_JaffaCakes118.exe

  • Size

    497KB

  • MD5

    77227411ed5a56e7f8caaaefb8551b11

  • SHA1

    6da36bf8e984c65361f8c473a14c63d6532780ac

  • SHA256

    3b776b91821efe686c53d5dff43dee312849131ecc6ac4ab92a3b6c4cc861071

  • SHA512

    98e906cc55e8cdfb6832a76b5f315e49e6ef543d9896dbc5206990c6c43d11eb92e9d861212b1c06bcea1b6579c11b9210f0746e7cdc8b5ec2b21ee10abc1d6f

  • SSDEEP

    12288:ReGtVfjTQSaoINAHT1ST82epyJ5JUkmoGNA:RLt4/NAwTWpA5aPK

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\77227411ed5a56e7f8caaaefb8551b11_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\77227411ed5a56e7f8caaaefb8551b11_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3100
    • C:\Users\Admin\AppData\Local\Temp\eduju.exe
      "C:\Users\Admin\AppData\Local\Temp\eduju.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2788
      • C:\Users\Admin\AppData\Local\Temp\ezhoj.exe
        "C:\Users\Admin\AppData\Local\Temp\ezhoj.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:3228
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2120

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

    Filesize

    304B

    MD5

    680defa5b44421ef7593588d21774a3a

    SHA1

    2afe4fe922217bcff4d30da926ea316f1ef40a51

    SHA256

    a43794c3a6e03c1513a14d5eb1a70229957907809f0cb12bc6ad71551fa84de6

    SHA512

    6b0fa160767207351c7688db84e99e28f60936ca88295f33d3c7d3060c73368f76a5c12df3ed98e2bdcfa391b41303b25fc61f7f07e492f6073d2740c1f13f23

  • C:\Users\Admin\AppData\Local\Temp\eduju.exe

    Filesize

    497KB

    MD5

    94b9a30b577a3d010cf4f5db5394c6c4

    SHA1

    33cb46138e3988f61938ffe6fecd586136e6d39f

    SHA256

    bf49215da39bf7bd51c02f5ee31bd04801aa96a89accef3a9129b35dac2ba452

    SHA512

    2fac45e2af85346728f45d77183fea4b7f6e216e4267f9323e0ab69c7666a05d4279c51e40057de420981f16a2573ad484b0835045446270a754eacf19969877

  • C:\Users\Admin\AppData\Local\Temp\ezhoj.exe

    Filesize

    202KB

    MD5

    d75b549f3f9726eea0dc31501f59bd37

    SHA1

    612d585b7b6a302ba364bd42faa3724358d43388

    SHA256

    b80a19f0b8204d7fbfb5b9f37cc15523e03890a1e7e2c0e1f019011655c50d1d

    SHA512

    58f44bbfb9fa45ce91634b33c22bb9ff0d531f580f4c18af8c8efb7e835261ad7052325b81caec73ef12c7f1c2dc2eecc0e9a034264c05e09557b8f581072c68

  • C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

    Filesize

    512B

    MD5

    f379ac09b25ea98ac141ead87d859ad7

    SHA1

    1b0d8eec881cbc255072bd193c3ff7a8d03bd0a2

    SHA256

    8d678e3c01f4940a4646087246b5a0137787956c8d98f65fdf32539074ed3ade

    SHA512

    1fb2d3313ddeb7a478471f5a230a7959974f9b6aac2f4515f72eab8660b35cff578b5d1c1b77913dbd3d4d2f4648ee89eff34734fcd7b80c02edc21293ce32fd

  • memory/3228-24-0x00000000000C0000-0x0000000000159000-memory.dmp

    Filesize

    612KB

  • memory/3228-22-0x00000000000C0000-0x0000000000159000-memory.dmp

    Filesize

    612KB

  • memory/3228-23-0x00000000005E0000-0x00000000005E1000-memory.dmp

    Filesize

    4KB

  • memory/3228-28-0x00000000000C0000-0x0000000000159000-memory.dmp

    Filesize

    612KB

  • memory/3228-29-0x00000000000C0000-0x0000000000159000-memory.dmp

    Filesize

    612KB

  • memory/3228-30-0x00000000005E0000-0x00000000005E1000-memory.dmp

    Filesize

    4KB

  • memory/3228-31-0x00000000000C0000-0x0000000000159000-memory.dmp

    Filesize

    612KB

  • memory/3228-32-0x00000000000C0000-0x0000000000159000-memory.dmp

    Filesize

    612KB

  • memory/3228-33-0x00000000000C0000-0x0000000000159000-memory.dmp

    Filesize

    612KB