Analysis
-
max time kernel
142s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
27/07/2024, 09:19
General
-
Target
77a44b3ecbf675944e8b433f2aa58489_JaffaCakes118.exe
-
Size
3.2MB
-
MD5
77a44b3ecbf675944e8b433f2aa58489
-
SHA1
76dd35e19141ae4bc907828673ff56a23211e9f9
-
SHA256
67f354dee55bd496e9a9c0c9526b8b7ac852c6d43b0d57529680808f933a5f88
-
SHA512
3f187816cc3a4c42d9ed3f5353e7457a6d249e50a1614b2c29fe75cda63ca07c8043b11d5804e333a2110eda05899103cc6921b27f1dbb43d6a88b6cef95aa3e
-
SSDEEP
49152:LuXKwDT8QrueZ115ULc7n0C4fXqBVg3LgebKUXME7667B6pEYTJrWPd6l3:LurDyer15+80nfX+y2UcZSIpEYTA6B
Malware Config
Signatures
-
ASPack v2.12-2.42 1 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\77a44b3ecbf675944e8b433f2aa58489_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\77a44b3ecbf675944e8b433f2aa58489_JaffaCakes118.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\install.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\install.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.3MB
MD58693ed012432bd9ccd87312528e6ef43
SHA1fcc851b20e3847e61543c0807cc5fc3846597702
SHA256a37af4b72d9248f654afd62b30e09ed81ad66ed27f129eabe44fd254ee72334f
SHA5128e3d0dbb379d1d959f12be3c446ad4e6d5a991c59a5bbd9889c0364df777ff4061adbddf8a53e82bffdc6fce83968adf412f2a71cf5f19e05a9f1ffeedbfe713
-
Filesize
2.1MB
MD51561349d0948d0cc902d60350db81c73
SHA13f1b97bfbde9e3f5cd2b10a24111c357f7ed970e
SHA2562b873b761bd79f25234083b5e3c7d87c6fdb4e17fd3679ecb984d3b5dcb70f9d
SHA512fa4c62b12e58db8bd4224d2a4a1ebed75a98657e43d1bef2d5395ebba30de615b4b4d9dfa73214f8a6d596e15e582aca56b97c3da65f56bdd4e6d6e8cac2a9ef
-
Filesize
327KB
MD5e2b28b269fb4894c9fa24f7e7ed37ed5
SHA1359636204430fe9548f6631a27dfb30ef74e3a64
SHA256b71c29f08f9c2e0c7d25bdd1778c65f67636f35b0af2c683185b4a71602f3c97
SHA5124aa314ec02b3a2b0ca3402c43413714ba540b9b9b93f5e2c68c523353b85c7c544d629f91f114cc36ddee12e3e84c5e6f4750ff9ad005be68d2cded49d0566e1
-
Filesize
747KB
MD5a9d16eb4f799fc85cfbd0a4047f1caa2
SHA1a0018d06810c20b499dced71cb1f1d3364c27952
SHA256c550095af5e2c966b3d278eff700721f032a80a065d95498dec6a1b0b72a3212
SHA5124a25127d3afc819405a2d1bea084b1fe24e1beb3fa0858a90334ed60bdae5c9f2823b3b7f5f378c790a0b2906c0159c871a90c2c4ae2afb2350e5618e4743122
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
348KB
-
Filesize
2.2MB
-
Filesize
348KB
-
Filesize
2.2MB
-
Filesize
348KB
-
Filesize
348KB