Analysis
-
max time kernel
134s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25/08/2024, 09:35
Static task
static1
Behavioral task
behavioral1
Sample
c07392e48322e4efde24d759d27262f5_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
c07392e48322e4efde24d759d27262f5_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$_3_.exe
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
$_3_.exe
Resource
win10v2004-20240802-en
General
-
Target
$_3_.exe
-
Size
1.8MB
-
MD5
77bfacca17ee1d89833b57f3a746d9a0
-
SHA1
aa9490c913489c5eafd02f67f875efcb56d23036
-
SHA256
38571b0965110d07c6fbf4813ab628d4017cf52c681c457fb3f184b644fb0b52
-
SHA512
21ecc2fce94a58cd39127964730b01722b9dafa20d3af65b023fe83188c08211ba1324849513ffc10b6a359737f98c4d06770dc1954f8880daff938a06581e6f
-
SSDEEP
49152:/SNY8H0ZGF5j51XdQTPRPgojx1NslvUOl/WkMWAH:oY00Z8F1XdUL
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation $_3_.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language $_3_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3648 $_3_.exe 3648 $_3_.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3648 $_3_.exe 3648 $_3_.exe 3648 $_3_.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3648 wrote to memory of 2876 3648 $_3_.exe 101 PID 3648 wrote to memory of 2876 3648 $_3_.exe 101 PID 3648 wrote to memory of 2876 3648 $_3_.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\$_3_.exe"C:\Users\Admin\AppData\Local\Temp\$_3_.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\11104.bat" "C:\Users\Admin\AppData\Local\Temp\6B72DFDC7AFF47FB929B76C6203EE359\""2⤵
- System Location Discovery: System Language Discovery
PID:2876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4440,i,1602949858158667699,12464335823361976127,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:81⤵PID:4548
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
214B
MD5739fcc7ba42b209fe44bea47e7a8c48f
SHA1bc7a448a7c018133edcf012bc94301623eb42c5b
SHA25669017cdbbe68396f45e41d211b22d800cc1afc0eadbd3440873038585020315c
SHA5122b2b130798b0f4e534626b9fb5deaa10bb1930e6700ac0ba7cf151c1bf3239039a7032ea67ceed86a4a4dbe981064c42a8e0f88fe8361e27002dd8ceb0ea767a
-
C:\Users\Admin\AppData\Local\Temp\6B72DFDC7AFF47FB929B76C6203EE359\6B72DFDC7AFF47FB929B76C6203EE359_LogFile.txt
Filesize9KB
MD5a987b94b705ae3c010b72e13cf33ef92
SHA1d0d833b418a3d4f7c31e2bf82390532b4c867e13
SHA256b69f22a3758b3e7d07a9a9f4509e1446242247225fc0ca8c6d646920bced0c6a
SHA512cd71eece0f6abf00fd5801d1dd162ef757cb2fbf3aee1f1a57e3f3910cc59774c4eb9a526a4e22d6b82b282f6522529e7e50ae6966f3bd81e722fa51b6bf66f6
-
Filesize
124KB
MD5edd0c0c692a4b46006e1fb1c167d571a
SHA129f6c045b1299c775e9385394f1689073393265d
SHA2568c6a6915fe9766b07cfe223a5c0555ed51b6932b3cf3f63aedc9218158d56e0d
SHA5124f5a4d057c7e6560297a81dccbabcab8cf34627bfbc1963f613796ab0695ff9836af6b1f22dfc06eb125edf8db11efa4d0e08fa54943fcba462837bdc543f481