Analysis
-
max time kernel
150s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
16-08-2024 23:07
General
-
Target
a04ccd45e72d51696af1edba4355ddb3_JaffaCakes118.exe
-
Size
566KB
-
MD5
a04ccd45e72d51696af1edba4355ddb3
-
SHA1
b2d5fb229853b90fefc3829b1b17821b782e83ed
-
SHA256
97b2a02d6cac62553669f2d756b7458ae08a64158f70e8ca9cd543710def99b6
-
SHA512
4c3f9f8263b2c373833c2391556064e6af3ad7783d3984970db5fb8b316c1cd6c4adf21e1ae06a8dfaa15e10c945d9d475e9df8bff4dbc3230418cb4fc667910
-
SSDEEP
12288:OUPrn7yb0UVxfWkg/Y7y6imupAVXuMGW8vVmS662kCPokukuWYJgsWEAa:OUPrn7yAQuR6XCABr8NX7CXuWY3WB
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
-
Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a04ccd45e72d51696af1edba4355ddb3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a04ccd45e72d51696af1edba4355ddb3_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\system32\catutil.dll",install2⤵
- Checks computer location settings
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Windows\system32\catutil.dll",watch3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Windows\system32\catutil.dll",xserve3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1AppInit DLLs
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1AppInit DLLs
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
479KB
MD5ad6affd8013bc184c58b5716dffd168e
SHA15d46f090f783eab6721d48702b4cfa741ebf1527
SHA256ed1d887daefab6e8da4b1844c8adde83a83110254490018c546b8b1e8defa5f9
SHA512f75203983ae8fa7fbd5c675576758cd19f18864bbca37540fb18ea290deef34d205f74e1855c066ddb605d6dc88782400f09cc518a0b86d24be4ba447c715e01
-
Filesize
1024KB
-
Filesize
574KB
-
Filesize
574KB
-
Filesize
1024KB
-
Filesize
1.0MB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1024KB