Overview

overview

10

Static

static

3

aa165c856b...18.exe

windows7-x64

10

aa165c856b...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/08/2024, 07:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    aa165c856b3bc7c3e331117d655ccbee_JaffaCakes118.exe

  • Size

    116KB

  • MD5

    aa165c856b3bc7c3e331117d655ccbee

  • SHA1

    3e36e6220b9f2bed5912706ddf9424f87e0c321e

  • SHA256

    ce4fc27a6d12c2258d8255a103eb6c296430a62385ece1b1fee42ec1396be92e

  • SHA512

    29ab13206e79282b6babb4b5721bf78b3e81c29c19f5d8f72fbf83bc808b8751faa2b21d432386af0a4180ce72181294788463c0332b45bbdba748be8a58e0c9

  • SSDEEP

    1536:A+cIRG3cyfCapmE5zkons4MBikY+msHH0o4vwo3L2YRTB6m8AJ05:AF4M6dE5zkPBir+miUoUEYRTB6ZYQ

Score
10/10
discoveryevasionpersistence

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 53 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\aa165c856b3bc7c3e331117d655ccbee_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\aa165c856b3bc7c3e331117d655ccbee_JaffaCakes118.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Checks computer location settings
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1292
    • C:\Users\Admin\keoexil.exe
      "C:\Users\Admin\keoexil.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:624

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\keoexil.exe
          Filesize

          116KB

          MD5

          7640b79be7811071fb4fa032917a31cd

          SHA1

          b30e9704cab0b4d72810037219eb0f9392d8e06f

          SHA256

          fb2d96fdb1b59a60cf79332099167e45264787bab95f28dfd28172eebc143e6a

          SHA512

          7042a91224110bcdaf42c5c53182765bfbd4d964b3ef9a1e27437559a3fc2d58ab7c3e3d4ddb97afaf53e77687f6ec7adc454926fdecc0ffae7dfd7b45108d51

          Download Submit