Analysis
-
max time kernel
141s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
16-08-2024 23:27
General
-
Target
a05d917aede42243aa5178c8272ebf40_JaffaCakes118.exe
-
Size
206KB
-
MD5
a05d917aede42243aa5178c8272ebf40
-
SHA1
50041e5b9e3cc959887a6b6a70427f09fa5d9e36
-
SHA256
8b7cc6e6cfaa186569ed769723b1032c6a46ab32425d8a66ac720dea4d93863d
-
SHA512
7c677830a3619fac446b2996618ec37d0e849734dd11b94e26cf2db1f8ee5d1dafddc6a4a22b2bda0751f0805a32720356a49a0d126f49e90edf973826d290af
-
SSDEEP
3072:3RFevpE5xO8A67pjy9orLXj/5szSCq94jVRtvr9TjsXOwdQT7I5hVs6i/ralY403:3XevT569m6Xj/5sXq9SRttjspQTGp9y3
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a05d917aede42243aa5178c8272ebf40_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a05d917aede42243aa5178c8272ebf40_JaffaCakes118.exe"1⤵
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\dplaysvr.exe"C:\Users\Admin\AppData\Local\dplaysvr.exe" C:\Users\Admin\AppData\Local\Temp\a05d917aede42243aa5178c8272ebf40_JaffaCakes118.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
109KB
MD53d4390bd44aeb8c678d7d132a38e349d
SHA1f63be11e0290449b4506903ed38ced03ead62e06
SHA2562a24e100b2bd9a2ed3c878ec126bf8d4517db76e43fc83a8814b0ae68380b9d0
SHA512647aa8a8522db085cd2b1cb7374ac87da97e629f86834c233d86b6a95281d10baf7be302ca83a6336188bbf05122499fc3ed3bf7e8f686f8e4c16cd0757bfcd1
-
Filesize
18KB
MD5c2a179ba2d9983e037ff68b66ea9a86c
SHA1d3486acc974125722cd63c100e184332c683f2e0
SHA256701971dbd0ca441921b93ea4b126d823c39ad6b332419bce0ab91ea3fd78623c
SHA512bf1e4403e7b93f7e27512a01dc646bf9d9caa58c67af5797b03fc6f35d25c3969346ee6c961d5b10c06c68817411eaf932d550cb133a1b290eaddceb9a9b31b5
-
Filesize
882B
MD5d9dc78b1be3d670726c00679c7f3b14b
SHA1b269e7e97ea12365a39a3037b9e7c7561019d0ff
SHA2565fdd84fdbb9a3cbd2e70232d0c8d8ecbe9b25dabafbaa48a341c27b01057f041
SHA51289e00860d64bd21ba33985087a1fdde2f33e762fd5eecf812e68d45a9f81e36a7d6cafabc0a4aac4d48abe32e64bc12cb45f6f10bcf44ff9c2beaedb51a20681
-
Filesize
180KB
-
Filesize
232KB
-
Filesize
180KB
-
Filesize
180KB
-
Filesize
180KB
-
Filesize
180KB
-
Filesize
68KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
68KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB