Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
18/08/2024, 02:17
General
-
Target
a50161c692176881f278e845982bfc9b_JaffaCakes118.exe
-
Size
233KB
-
MD5
a50161c692176881f278e845982bfc9b
-
SHA1
009b7179b030277ed276ddc71990f50ee4f91db3
-
SHA256
96acee8598de8b9e84b407d971bbb4c1f60aead6135e509a3c79ab5e8aa2726a
-
SHA512
3daa0057cc89f301380e51b9d2d80589f59fe6935865ced2979c796fa274123bb93e25274e70ec325d712ef71a73a7a64374c49c2903c05ae1db282d1a014596
-
SSDEEP
6144:VNSDyeRO1thpBu6ZGGexdkXJhT0PmJVGEvjDx7p:/SDy/1tjwxdkXJZ0mJl7p
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops autorun.inf file 1 TTPs 3 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in Program Files directory 1 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a50161c692176881f278e845982bfc9b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a50161c692176881f278e845982bfc9b_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Documents and Settings\tazebama.dl_"C:\Documents and Settings\tazebama.dl_"2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 7403⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2312 -ip 23121⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
164KB
MD527d39f9bf3b7c4a9b52e243ac0da1905
SHA1bd7f91d2068b592076319c014048c973a64d0de8
SHA25653918ff27bbf926fc8c103443f1493441c12381b2069da9c77efdec4304aaf3d
SHA512a57860dff6696525658d0fb4b6870f4ebe9d0ce87636e6ba34034667369a5ac38f13b0f787c76db73eca7559ba8cb750d6258ca32a189e4c7def4c345fd35023
-
Filesize
32KB
MD5b6a03576e595afacb37ada2f1d5a0529
SHA1d598d4d0e70dec2ffa2849edaeb4db94fedcc0b8
SHA2561707eaf60aa91f3791aa5643bfa038e9d8141878d61f5d701ebac51f4ae7aaad
SHA512181b7cc6479352fe2c53c3630d45a839cdeb74708be6709c2a75847a54de3ffc1fdac8450270dde7174ecb23e5cb002f8ce39032429a3112b1202f3381b8918c
-
Filesize
126B
MD5163e20cbccefcdd42f46e43a94173c46
SHA14c7b5048e8608e2a75799e00ecf1bbb4773279ae
SHA2567780bee9df142a17e0457f3dcb2788b50fc2792370089335597d33719126fb7e
SHA512e5ac0ff6b087857799ab70f68067c9dc73eeb93ccfcad87047052380b95ade3e6eb2a7d01a0f850d548a39f4b1ebb60e299d603dbe25c31b9a3585b34a0c65a8
-
Filesize
164KB
MD5b773216e8221106c2d0e57c98d8f06b7
SHA1272c556bdad29a90afbc126350246dcfe2c12158
SHA2562859816fee2650bcff6aed168e9e53e412c7458450c135b3fff679d0dd53a61c
SHA512effbb24ad76e4013ef430ce3b2b16b0eeb5281ac056157470e5ceb0820e64c1e72d674df4db742d5947ebd250d0639b1fed9abce23938927b0bf930a6bd7054d
-
Filesize
164KB
MD5a2d86858b46ff6d02f03257938e93863
SHA11a78016f40747cb80918cc420b3969bfa9710d9e
SHA2562ce2c427c2e95900675a936a7b80090f5ba4e42cec8ffa423a222dea5e72cf9b
SHA512aa0e93578447d7a5611d0c1da6ca714f25c4d7d3ae5bc88f31bb8dc9706c548f8c3c34fbc75862659f1c82d3c8af702de1149b0ebc95191d373a50385d3d556d
-
Filesize
48KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
48KB
-
Filesize
80KB
-
Filesize
104KB
-
Filesize
104KB