Analysis
-
max time kernel
92s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
11-09-2024 03:51
General
-
Target
d98f5f5006f27087a853301c7141fc48_JaffaCakes118.exe
-
Size
677KB
-
MD5
d98f5f5006f27087a853301c7141fc48
-
SHA1
6044c865a6a1328a799398da1455ffb5b10476da
-
SHA256
0caccf6c29f5d450cf512b57349874e056d0225e39ff724f461753494ef73e08
-
SHA512
9441ec3bd7ceb75ae6a0fa44f3c4c7bda3913368fe938d190e9f1649087c61e7ffe738c143e903c84cb8abb5ecd18ccbda5276a6c56212954263928b07ab2de0
-
SSDEEP
12288:VinPEoH6fh/RE8MyAsfYER+DYLOUhYUGwQZQd8+UrdFplP3Jf+A5ahnwMqg8pHC:VLlh/RxMBsb+AOxUmed8+8Df+AInxcC
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\d98f5f5006f27087a853301c7141fc48_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d98f5f5006f27087a853301c7141fc48_JaffaCakes118.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /s "C:\Users\Admin\AppData\Local\Temp\GIRL.PPS" /ou ""2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
621KB
MD5b133618ea3d2b29e0c5f00fe16ca02e2
SHA17d2051b2f65460d0c2fdee26aea6ed23a957d40d
SHA256d94f6cab9cdc764edabe5a25c56be8d3b05d6e74a6179b4e454a9ddc0e20efd5
SHA512e6de88d7362a9de0715dcfb3883d7e6ce220d9b188e023b9a37dbdd8728c55001491f69b882576bc18bdb210042fb86494967cbdb72ea2b9f31eacbea9ea6c04
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB