Analysis
-
max time kernel
141s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
06-09-2024 18:14
General
-
Target
d02a7aeeb68e9490f46067f2e73aad91_JaffaCakes118.exe
-
Size
4.8MB
-
MD5
d02a7aeeb68e9490f46067f2e73aad91
-
SHA1
46c23758adf8e8ba15f31851ba53040224e187ab
-
SHA256
e3f09a4f585512b2d597b0aacef5e95887aedc1c68556d4c8880113cab94144e
-
SHA512
921a8f73e25988056185b1cbbc8b413e6e1669ceeab418f4323d67900ffa8d8383a584c68166a9d557429a02160dd2af180c76927f181cb6462644cdc1e33d45
-
SSDEEP
98304:Ct6xS/jD6laC1GUqLQuZyM0vyGkt50rsI6NQ3giOvo7avbH0rT:CVKlaCjqLJ4M06Ga5DI6NQ3svbH+
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 6 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 12 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 6 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
NSIS installer 1 IoCs
-
Modifies Internet Explorer settings 1 TTPs 6 IoCs
-
Modifies registry class 64 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d02a7aeeb68e9490f46067f2e73aad91_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d02a7aeeb68e9490f46067f2e73aad91_JaffaCakes118.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Screentime\STF1\d02a7aeeb68e9490f46067f2e73aad91_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Screentime\STF1\d02a7aeeb68e9490f46067f2e73aad91_JaffaCakes118.exe" /l=7865222⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Screentime\STF2\install_flash_player_10_active_x.exe"C:\Users\Admin\AppData\Local\Screentime\STF2\install_flash_player_10_active_x.exe" /s3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.3MB
MD5d503c4f7d744989ca7b3798d7a9bd6e2
SHA1f3392fd54890838d58bfad4dfb5101bc8f9f7990
SHA2567e9acac11fd3549311f853015ba87cd8e0942725f652a5727b5e5278dd51437a
SHA5120e113f39ef291d69cdd18bab30a3a8010ebcbff3a0f6635284a9ef3dbf01e6fe4bf2f4f503b797f101efede0740798c73f4f338c13a9409f7abec7ab00e37340
-
Filesize
1.8MB
MD5c41b29f0fee117ced47248cc7fecad11
SHA186745020a25edc9695a1a6a4d59eae375665a0b3
SHA256594d0d699566fbbec4e733ba0c603cb6e6f6fc3cb8901eeb715a037c99c4c38f
SHA5128734722bcdc97dedaa3fd31e2ced14748b54bca5847f0b0ed2fbb4a7dfe463a47a11d10e9a2dc85f4e2f883be1b4b4cf56038099624c7c37a6b313db5bf6b25b
-
Filesize
17KB
MD52b8574f6a8f5de9042baa43c069d20ba
SHA107959da0c6b7715b51f70f1b0aea1f56ba7a4559
SHA25638654eef0ee3715f4b1268f4b4176a6b487a0a9e53a27a4ec0b84550ea173564
SHA512f034f71b6a18ee8024d40acd3c097d95c8fd8e128d75075cc452e71898c1c0322f21b54bd39ca72d053d7261ffbab0c5c1f820602d52fc85806513a6fe317e88
-
Filesize
10KB
MD516ae54e23736352739d7ab156b1965ba
SHA114f8f04bed2d6adc07565d5c064f6931b128568f
SHA256c11ffa087c6848f3870e6336d151f0ba6298c0e1e30ccddf2da25a06d36a61fc
SHA51215dbfcdc5dc34cb20066120045e3250f8df9e50b91de043f2ada33ac0235907d98668e248828a7ed9c75e25dfb5103b7248867530ce73ee36f6a35c30b4afa9f
-
Filesize
4KB
MD568d73a95c628836b67ea5a717d74b38c
SHA1935372db4a66f9dfd6c938724197787688e141b0
SHA25621a373c52aaecce52b41aebe6d0224f53760fc3e5c575e821175eee3a1f7f226
SHA5120e804deab4e647213132add4173c1d2c554c628816f56e21e274a40e185d90254e29c8bfc6fbfdfea2a492d43d23c0bfa4b276252a3f5e1993ab80ff832c4914
-
Filesize
8KB
MD5071b6233c92f69ffa1c24243328c3b94
SHA1bb583c00e87cdc65e6254c7148d37afc1bbb3095
SHA2565f6c63cb0ba539d692c5461730f057d0ec6c60639d772fbdc3753c3c6e746c43
SHA5127fc2db406350488ee86ccffe1e99a91e0f509ef0429063336bf6f96aab07127df352db77fe9d00ddc3aa2db7886dfbac08b6acf6a5c647859956111ca47c24f1
-
Filesize
3.7MB
MD58afc17155ed5ab60b7c52d7f553d579c
SHA1fc3087d8acb839e4cfcf14c9982c0e4d8a1c7109
SHA256a7f7cd44461e11d1b8be467bd4e4a22ae05b6df29260cc0b9d43a6314fe2a375
SHA512b22b3d280a7d8bb6c5131c98c7270010d5aabeeaf8092596d5e8f024d1820cf4c0bfa42d6ed1f2a6cbb82ab4d0f3d48ef873c4edf307078e51618decc1eeff92
-
Filesize
4KB
-
Filesize
536KB
-
Filesize
4KB
-
Filesize
980KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
980KB