Analysis
-
max time kernel
139s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
17/08/2024, 17:34
General
-
Target
a379b12c9858dd871c041949135b8309_JaffaCakes118.exe
-
Size
97KB
-
MD5
a379b12c9858dd871c041949135b8309
-
SHA1
681c32c3a20d7c434a2229d1a95aaabdb50466e1
-
SHA256
bfd7c64d027fa97bd724229be02c6aacc9576e4bb8b6411eae081c10a7b5a579
-
SHA512
7c051da8d6d0a8d564c744a3de6458290a395731c76f944ed9376cdae261466e1535ef9a4ad8c5e991b859ca4bc1eb525eb45bba33950f083aa436edf2e932f8
-
SSDEEP
1536:9fTiwKE9scBhfjPcV0G2IFc8Hs2YgLlXZ9XNnouy8/R:9DP9xhfjPcV0Ey+RYOJDoutp
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
VMProtect packed file 1 IoCs
Detects executables packed with VMProtect commercial packer.
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a379b12c9858dd871c041949135b8309_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a379b12c9858dd871c041949135b8309_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\ctfmon.exe"C:\Windows\ctfmon.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
66KB
MD59672a18b1b52629d5e2ecd75ab79b0de
SHA1f27fcbe6c25fe0352980dd3fd800d9de3955c2d0
SHA2566674d84db2c299f201bb1b75a3ca50e0cbb013a5f6db34ef9b534546f70a08f6
SHA512e21d3539dd4e20feb423e485ddaf650b850b13c6b03886cebde7f3cb6d48743888dd5861d76d6c08b702922aca7516fb8ac336c37ef5c4561e9bac729aeb6942
-
Filesize
207KB
MD51c1760ed4d19cdbecb2398216922628b
SHA166b6158b28cc2b970e454b6a8cf1824dd99e4029
SHA256d66458a3eb1b68715b552b3af32a9d2e889bbf8ac0c23c1afa8d0982023d1ce2
SHA512f058eda0c65e59105a7c794721697782f1e1db759c69a11dab09ca454aa89767addcc8ecefa54995527bc2cae983e44c9ed42b0973fdb47435b31428150b96db
-
Filesize
104KB
-
Filesize
104KB