Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/07/2024, 10:01

General

  • Target

    77c4abb07290abb02534c2722d489daa_JaffaCakes118.exe

  • Size

    240KB

  • MD5

    77c4abb07290abb02534c2722d489daa

  • SHA1

    b88af4cfcb3b481afb7c5d4dc4e4247bb07cea88

  • SHA256

    08e307d12541463c4d04739afc0c63ecc78b840ce11c90cb3bf29911d09a815f

  • SHA512

    fd172ad628dcc348ab96bcd7a490b9da3ab9249b79376e8cf13e06b2277e72202f9bf2ea5432c0927f91bd56f6cd678a15b4c725697f77cd2d0053fddc164922

  • SSDEEP

    3072:GOjzVvHjQdrgUDdCGAX31X7tlcxEHglJsd1/Ab32yZlOsQqO1j99M3:NcdlcX31X7tlMGFTy6sQv

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 27 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\77c4abb07290abb02534c2722d489daa_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\77c4abb07290abb02534c2722d489daa_JaffaCakes118.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Checks computer location settings
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4908
    • C:\Users\Admin\boijeur.exe
      "C:\Users\Admin\boijeur.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:1524

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\boijeur.exe

    Filesize

    240KB

    MD5

    4b1fdede9deb8e46807466f99b5c6823

    SHA1

    9ea3271a03040eddb30da1787459df32dcece6d4

    SHA256

    a90c80edfc3c78424ba95a4dc95a97309e29f62689e52dc3c7007b779a6a67cc

    SHA512

    f673b05c688cdb11a1d8ba5536f4878c9f5d93687e2a65e5fe2dcb7e632e82e33587f20ac1c0bfc4a40868a5cebe4976f05a39429087c8665a8dc7ca09ba8291