Analysis
-
max time kernel
150s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
06/09/2024, 19:22
General
-
Target
d04aee33bdc7eaf81c434f60414e5f8f_JaffaCakes118.exe
-
Size
256KB
-
MD5
d04aee33bdc7eaf81c434f60414e5f8f
-
SHA1
b51e61cfb36ba718e4af445d040de22f3a7c7392
-
SHA256
07f1037b8d6650c8d4aedea072a2525a2cb5f40849fb43a86e2a6582f1aecc20
-
SHA512
9cc0ab58699ee5c948adfc6923c22c1533ac63e8d7a13ed67070a07370c66a559b0131b09513df639c5a02221ae8ac336304d5d27d073165ab0c7da947357b22
-
SSDEEP
6144:+Gzf+/hOSZouvcOZvoZMZjnpWA5Gno3CK:HK/JRvNoZM1V3CK
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 2 IoCs
-
Executes dropped EXE 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d04aee33bdc7eaf81c434f60414e5f8f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d04aee33bdc7eaf81c434f60414e5f8f_JaffaCakes118.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Marxereals Sequencer GUI.exe"C:\Users\Admin\AppData\Local\Temp\Marxereals Sequencer GUI.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Sequencer (KL).exe"C:\Users\Admin\AppData\Local\Temp\Sequencer (KL).exe"2⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
86KB
MD5801a41c9165b85cd76e80bc96fb7ac52
SHA18858695fae3231f3301354d9ba28bf4b66b47a86
SHA2568478c3f6f6cd12af227dcbdd16b887b420b002d9e4448a62a7dc47a376c9394a
SHA51232bed322e34d8c27631ab0c69febffb1611e05c2cae97cacd32dec1999989e02323e8fe8882b1dd987ee7307a52decd0c5268ccdaac0a3eb65c250d207f9e689
-
Filesize
90KB
MD5baa6b5e1c23e5a04c0a01823b43d7965
SHA164b476abf2914abb4af388cccf253fcfa1f5475b
SHA25629b97d4644d457c90536ce8426a51dde8e10d2335c3072f367183bc4ac4393dd
SHA512d8b83a5bd87b5791a53cd63a7c5f0f0d85b35e29d9810d1e728eca8cd9a445febcfc87b79b8be8f61e45d1647ebb7eb2102ef4586563fda26a7a0e9aeaccf898
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
120KB
-
Filesize
7.7MB
-
Filesize
120KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
344KB
-
Filesize
7.7MB
-
Filesize
40KB
-
Filesize
584KB
-
Filesize
4KB
-
Filesize
5.6MB
-
Filesize
624KB
-
Filesize
48KB