161630d8beccf5fc2c83ecedb1124132a053e4718d5f1879b15f3d4f419ef5ba

Analysis

max time kernel
95s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13-09-2024 15:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

de717c6b27984fd3ca4c9aeb6b4f9a93_JaffaCakes118.exe
Size

929KB
MD5

de717c6b27984fd3ca4c9aeb6b4f9a93
SHA1

cd9fe130bc694f8ad33712e2441fca97d2631bae
SHA256

161630d8beccf5fc2c83ecedb1124132a053e4718d5f1879b15f3d4f419ef5ba
SHA512

d8074b8b40a1cdf3c5a5014a13916496dcea3f779da9248b68692a78b607ccf626df4576bf5f524a9ce823543faef547734dd186ff8808925be26fc78b347917
SSDEEP

12288:JocdNNqlqhJMlMDaHz0DO8bMVuxezcO215kO1jYf2NByrLCz66IdI2X+QRoGELFz:JoQNmMagD+hgOqL1jacByPCzsB6gXidV

Score

7^/10

discovery upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	de717c6b27984fd3ca4c9aeb6b4f9a93_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
3056	v3exclv.exe

Loads dropped DLL 47 IoCs

pid	Process
3056	v3exclv.exe
3056	v3exclv.exe
3056	v3exclv.exe
3056	v3exclv.exe
3056	v3exclv.exe
3056	v3exclv.exe
3056	v3exclv.exe
3056	v3exclv.exe
3056	v3exclv.exe
3056	v3exclv.exe
3056	v3exclv.exe
3056	v3exclv.exe
3056	v3exclv.exe
3056	v3exclv.exe
3056	v3exclv.exe
3056	v3exclv.exe
3056	v3exclv.exe
3056	v3exclv.exe
3056	v3exclv.exe
3056	v3exclv.exe
3056	v3exclv.exe
3056	v3exclv.exe
3056	v3exclv.exe
3056	v3exclv.exe
3056	v3exclv.exe
3056	v3exclv.exe
3056	v3exclv.exe
3056	v3exclv.exe
3056	v3exclv.exe
3056	v3exclv.exe
3056	v3exclv.exe
3056	v3exclv.exe
3056	v3exclv.exe
3056	v3exclv.exe
3056	v3exclv.exe
3056	v3exclv.exe
3056	v3exclv.exe
3056	v3exclv.exe
3056	v3exclv.exe
3056	v3exclv.exe
3056	v3exclv.exe
3056	v3exclv.exe
3056	v3exclv.exe
3056	v3exclv.exe
3056	v3exclv.exe
3056	v3exclv.exe
3056	v3exclv.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4492-0-0x0000000000400000-0x0000000000415000-memory.dmp	upx
behavioral2/memory/4492-93-0x0000000000400000-0x0000000000415000-memory.dmp	upx

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	v3exclv.exe
File opened (read-only)	\??\B:	v3exclv.exe
File opened (read-only)	\??\H:	v3exclv.exe
File opened (read-only)	\??\I:	v3exclv.exe
File opened (read-only)	\??\R:	v3exclv.exe
File opened (read-only)	\??\T:	v3exclv.exe
File opened (read-only)	\??\J:	v3exclv.exe
File opened (read-only)	\??\K:	v3exclv.exe
File opened (read-only)	\??\N:	v3exclv.exe
File opened (read-only)	\??\O:	v3exclv.exe
File opened (read-only)	\??\U:	v3exclv.exe
File opened (read-only)	\??\Z:	v3exclv.exe
File opened (read-only)	\??\G:	v3exclv.exe
File opened (read-only)	\??\L:	v3exclv.exe
File opened (read-only)	\??\Q:	v3exclv.exe
File opened (read-only)	\??\V:	v3exclv.exe
File opened (read-only)	\??\W:	v3exclv.exe
File opened (read-only)	\??\E:	v3exclv.exe
File opened (read-only)	\??\M:	v3exclv.exe
File opened (read-only)	\??\P:	v3exclv.exe
File opened (read-only)	\??\S:	v3exclv.exe
File opened (read-only)	\??\X:	v3exclv.exe
File opened (read-only)	\??\Y:	v3exclv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	de717c6b27984fd3ca4c9aeb6b4f9a93_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v3exclv.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3056	v3exclv.exe
3056	v3exclv.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4492 wrote to memory of 3056	4492	de717c6b27984fd3ca4c9aeb6b4f9a93_JaffaCakes118.exe	85
PID 4492 wrote to memory of 3056	4492	de717c6b27984fd3ca4c9aeb6b4f9a93_JaffaCakes118.exe	85
PID 4492 wrote to memory of 3056	4492	de717c6b27984fd3ca4c9aeb6b4f9a93_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\de717c6b27984fd3ca4c9aeb6b4f9a93_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\de717c6b27984fd3ca4c9aeb6b4f9a93_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4492
- C:\Users\Admin\AppData\Local\Temp\SFXACF9.tmp\v3exclv.exe
  "C:\Users\Admin\AppData\Local\Temp\SFXACF9.tmp\v3exclv.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\SFXACF9.tmp\V3Pro32e.DLL

Filesize
84KB

MD5
967446ba84e660b6eb81c599df8c6086

SHA1
0643d859a5787fb7ffbd7832c6462eee4a35289f

SHA256
3d556a83c350ab14ac01fd636fd0d16887e3ea034ae44fd47f80be33f29ba2aa

SHA512
437f3a448e27a68663c1f391c568f56a393296cf9e5aefbe94a1d4101a7aebc84071c54c0776eb649e123150e9c46d457deea2b63f5d0c77810b29060ebea3f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\SFXACF9.tmp\asc_com.dll

Filesize
76KB

MD5
25a48d5f1c7e1ecf56349e99ac4fe587

SHA1
33da9c884bc9a106ea3eff4e452a98b17126b18c

SHA256
2bf4ab285c7b25c96c3af7edf15be8dc834bb8d0f8814b4015b19580d1b43965

SHA512
30368c4bbf2571dfda0a5c4f61f33f862e58b2145466e0dba6a456fe817dbf5d2b2becdf2856cd640546df70445486deebcf4b736244c70a71d2f73c9f10fa12

Download Submit
C:\Users\Admin\AppData\Local\Temp\SFXACF9.tmp\asc_dh.dll

Filesize
60KB

MD5
fa16c3c46433ddf96ae4133c7812d9a1

SHA1
bf7bf940db50e116dd19e14d01ebd7336498b543

SHA256
bc8a62405f74612239c1b1f5bf4bc1fcd92f00dc335ce942ef18c32979002cf6

SHA512
c6d84fe8fb4c73dbeef386167116b700d9fbac833c09d45365ef78902fe1daf17c39c86b66ca104c98dcabd9b41b71dbe7658d20bfed10f8f5977423718cd803

Download Submit
C:\Users\Admin\AppData\Local\Temp\SFXACF9.tmp\asc_fse.dll

Filesize
24KB

MD5
6a9cfda3df9a01431034d01bb8455b36

SHA1
0e2011f6df3870abbe248cf34fdff104007d51cb

SHA256
9dcff3a4caae938bef814bb359522fb778ff76e21b8ac476601f04fc23e6e053

SHA512
4938a88725bae32bb17dc81ca6eb1d9354a075c9079771a558cb434eec6d866c3825a419a92f86df62e40157c9c17935f00f1836b7ebfe080282315640eff619

Download Submit
C:\Users\Admin\AppData\Local\Temp\SFXACF9.tmp\asc_mmgr.dll

Filesize
104KB

MD5
c8f48081f27e2aad229bdf6ceef83a7c

SHA1
f6af2fa8fd642163ebb9acbba4a6ef892fdecd90

SHA256
a2ec617bead7996162984299620010d39e385fe443f27ea8b132f5c766c70587

SHA512
b4cab1de77cd5ae780a8319b245b6d4127630cf7db6cca4d6b0759efacfb7553f7445e2a6b601cafea8bf5ef699ee6af8a44e8015b5795cfc59d046bbbb8100f

Download Submit
C:\Users\Admin\AppData\Local\Temp\SFXACF9.tmp\asc_reg.dll

Filesize
48KB

MD5
eee91a17d52a43a3ff3e9bb15cc602b4

SHA1
8321c2db8ff583b462165576c2e7d7625aa30cb3

SHA256
95c3e63cf09a7e202e4b6a32f2d3c2182539eb94e40014f9612a3b8bac46098d

SHA512
075096104d7d3ed32ee79369bd8f34ff6737e92f14b527b8576e61f425fe58b167846c1e6d2f9c9667d6648a168edf2736bfe89e7dd839b0f2de5a354f2cb5f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\SFXACF9.tmp\fse_base.dll

Filesize
28KB

MD5
cfdd6ab4f9c97f1e1fbe0be8eadf3ae3

SHA1
cd0de385fb45b1001a26ca598515a8c940c94436

SHA256
28300742c0ed933f246faa52f0aac1ce7b7fdf3eb3b32757b8e456e9def56732

SHA512
2cb13cc965a99bf08710e14b06b9e952b3e0ac08fbd4368e4243245f96850aafa5aa5f9f9ff21b6c31164c2570546fc8e427461adfa707cb8a50d1b3e9bb9198

Download Submit
C:\Users\Admin\AppData\Local\Temp\SFXACF9.tmp\fse_dos.dll

Filesize
212KB

MD5
15112bf92dd253bcea0da84e75f92d19

SHA1
a3d459b800cedac06be30db58d52d586cf8135a0

SHA256
24977a2d9290a46ab01e6f84612a3e988897d1732f8bb7d6f8c3f6e55eae10e2

SHA512
fcf8e17e7611d22552204adef1147ca11c0634e8b3a8cc0a24f5cd01f7f7b76581afc48782dc1c3e9142ba586f19e25e4f8fbee5ea8536c4794d9c4aa257765c

Download Submit
C:\Users\Admin\AppData\Local\Temp\SFXACF9.tmp\fse_fact.dll

Filesize
24KB

MD5
458aa27811be4f00fef8fa462d9bea4a

SHA1
93fa1ad95300d3804099029378d719e22a93096d

SHA256
c66a1eb7a2156c4ff425728ed36186b5643f06401ecc3b46dd0517caf7f6a7aa

SHA512
030e5f0ffacb13570b2704ff6d469de042980a47b07ea3c683c47d5895fac9da2ec6f341997918483240fdca7b14c616feb70e6e093d29c1c3040639407974ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\SFXACF9.tmp\fse_file.dll

Filesize
120KB

MD5
82ca38c94e3be4d5bd56ef38b44171c5

SHA1
d72b8ddfb003948538ba0d59887f0c37ccd3bbf6

SHA256
67e8f9908cdb8a1ebe353f4de921f95b4659de95ef15dd37fe23e6c87da9ba49

SHA512
5c7cbc7985a22623f3841c8335c82e3c4d154291e9a678870eec653f6d49a9c624d10f9c274ca4242d5805c2363d793a5a7e72b4420e1b9de56010f9d181b14f

Download Submit
C:\Users\Admin\AppData\Local\Temp\SFXACF9.tmp\fse_pe.dll

Filesize
52KB

MD5
ec0fc5c7f82660c880a78a9e767fbacf

SHA1
56cd2b95bf727ba3e1002728cd5270024749214b

SHA256
b22803dc0c2ec0febc03a40617ff69b4ae7f81238522aa8df51c330707b8cd93

SHA512
e967534b33bd20f507e8614d6ce03617956f06077bc989f677df9e87a3a720b9a57de9af7ae15fbd323267424fb635e8b14d518df30217bbf270983e6e20c579

Download Submit
C:\Users\Admin\AppData\Local\Temp\SFXACF9.tmp\fse_pe2.dll

Filesize
406KB

MD5
85da5448b31f0b890bf0c853f49acf87

SHA1
e9febc040b8e7324d2d7169a4e61fdcaaccd22ea

SHA256
5c6d6e9d4ce2f28642f5f493452fca54c51305246964f22ae93fe8cc8e9b0637

SHA512
7338aedd935076731a2ca3303e4145f3c4c9378bd73ec11282d01ff3426271dffdcee67f80574a511864696f67d5f6726df6fe55184102d8fe46b447e7a5c762

Download Submit
C:\Users\Admin\AppData\Local\Temp\SFXACF9.tmp\gfs_base.dll

Filesize
28KB

MD5
bb6f4c705b6ff37a5b8317595ce645b8

SHA1
c875a10888f1a736fb60d26db6afe0fcac285f77

SHA256
5b742b73b1b568d5f0d08d8e2c5f5a24f59faa1d5a05067956212d5770eb34a2

SHA512
ef28ede274921b1aef26e0f4aa4ab5e390afdce5067c01586429365f3c880341846c424bfa501c84d26ed5a33a4047e4c56d5ede2b13024426bcf57c1aed9c1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\SFXACF9.tmp\gfs_fact.dll

Filesize
24KB

MD5
edcfbad0cb2233879d379a67404ef718

SHA1
76a29792c2433e14829f54592be1a662b448e1c0

SHA256
4c8b3bf7c0f9ba1accbac2cde9021e2d975fe7ace40d6a028e15c57468fad841

SHA512
957f5180684fb536731442837101e7683db665df2be1865be1413f1bf7afcaf9c844b490b422f00a14d504f9d86930b12efe9cdec83ff40c56e230b5201e223c

Download Submit
C:\Users\Admin\AppData\Local\Temp\SFXACF9.tmp\gfs_file.dll

Filesize
32KB

MD5
23beb506f84a5255ec954edb65e8df9c

SHA1
0669373432998a5e4188b59f4b18e37f677c1f9a

SHA256
a9580d3761b73bfa05b698021960f3e656424ef96921f9ca1f53bda8a88a3a0c

SHA512
511ed9d693c5a87e7c2644ca76ad5339f12e380e7e99e6ff677355d34d01d54f01ec397319d20ea734b55851ae94b50b69e9a3f57db6c88a6c96cbc59c190541

Download Submit
C:\Users\Admin\AppData\Local\Temp\SFXACF9.tmp\gfs_mem.dll

Filesize
28KB

MD5
e77337af666e49b6c03a03b635bc0149

SHA1
ce1a11e2778e657cf29fd1cbb7f1770fdab60207

SHA256
90f44637c6e2c9035182d2edf5906d0ed422b9d5cb5926349c07b7fbd9499c78

SHA512
590fe2c9363123109f1935f86a33a20f8f8e794ff8df6247910c1cc515d0afb18dd104c856432392999b904a580dbc72e10fb295b82b544ee2e405e49d824acb

Download Submit
C:\Users\Admin\AppData\Local\Temp\SFXACF9.tmp\gfs_ole.dll

Filesize
52KB

MD5
b08695b49d82513c65a213e709e5c888

SHA1
d87eafa21953aadcbc7e8c419963e9a2a98fe7a2

SHA256
5b8bcdc26aff6e89a17e8f07c817357c524ddfc1be25bd21d12019ca87e63b62

SHA512
b58546d98bc27722008b1b8dd3a141b0af5ad09aae5a782e8f3cf85d15a3b463a74015b909fe6566ec8b3a20d3df5c5d5ea73ed9cdfe67dcc072500abe284a77

Download Submit
C:\Users\Admin\AppData\Local\Temp\SFXACF9.tmp\gfs_os.dll

Filesize
32KB

MD5
aff4608aa62ee0bbb5e450e5bd4b2b20

SHA1
16a163dae8995f1bc12094504ac2adc5c82c099d

SHA256
b7b6cda93d6b2e86c7685f7ae124ad171cc72b7bbb113324f6a923185ab78bb3

SHA512
45171337235987f3dcb12bdd02ed273640065ea085552c067e005b8f45735ecd840c8b3b4992f65068c31ccd69280f1be3e7fa0644e01e71cb8e2ba3a3155349

Download Submit
C:\Users\Admin\AppData\Local\Temp\SFXACF9.tmp\gfs_proc.dll

Filesize
28KB

MD5
057fd4277a4254912a0feec90c007dae

SHA1
81ef4ab2a6088abd4ac40662168592177a8068c9

SHA256
13217d27a495ab4d0f4cb1876c375cfc6e368276d25d66aab1951c6c8ec68eb4

SHA512
551caf479cd728e72a1dc0dc7a4c04ffe7988c3c150b0cb66f1dddd9460d899283fdbfa890cb8c9d0b6827fb23c769855f4ff4ee25da6f5b73e85bd78708f3ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\SFXACF9.tmp\gfs_strg.dll

Filesize
28KB

MD5
fd938a88ff702e34a61f6c8f081b6f6b

SHA1
0c82b73554768448c53c8034d4a63420b42073c8

SHA256
dbd5ffee4d5756fa2d7080d74bbc11908a9a32fc6420ac5b96bbcd6fc6b77ba2

SHA512
c69aa2a39e5cd1493963fb9224f919e8066bc7bd80b741502ff84f7a8a61de4631ae670bff9cbc80ed6350d3da78872c10a6b15586184ea9713286c89bd47148

Download Submit
C:\Users\Admin\AppData\Local\Temp\SFXACF9.tmp\gfs_util.dll

Filesize
28KB

MD5
05dfde73f04974b1000fca69a2b33886

SHA1
b57520ca3b27701d26f4eb29239890c433565072

SHA256
dd124d1e8fd7fd405f1831310044b97196e748a05c8d7116d89559c20d4a0fe1

SHA512
666b68abc5c26073f7ecb9864c609d9e32733ac3b6d605c92cf55d00a11bec60540eeaab780cdff9f27b5b06dc4060d10355e525156246b3c8b722884b58ab1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\SFXACF9.tmp\moduler.scd

Filesize
4KB

MD5
ad08393db96018510fa087b53e5910ec

SHA1
6efcb6a8be2cdcbf881ffe1c1a79a29e05a1989e

SHA256
d45509da09e665d54f45a3f5a2735120bd230681c558086c3850a7b9e1550986

SHA512
60afceea82f2414d7144c5bf78e36afef87e6ecf2a2a6e427f3f1a50a455a23fb466a3847e0680cae7084f035b8de9083cd47c4da734d166e25722e4c5df19f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\SFXACF9.tmp\modules.scd

Filesize
683B

MD5
e006bca1385916bf619a33428766702c

SHA1
c54800c659956b6b22c19fec14024a6f9bdd9ebc

SHA256
a0c448e28cafbf0e2244bdf0cf3df631947b805e7a53267dd7c8280018ed3196

SHA512
2691a13181fff03640083413a0e3c68b7cb58850872b332ff23a9274c8cc5a0f325a95f7a2e516bc68ba48f18cd72e0c7c2f10665c592f3c6ea5e98f8fa1c0fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\SFXACF9.tmp\v3exclv.exe

Filesize
88KB

MD5
1d828222f1dffad4d3cdf25b3e4dad7e

SHA1
1381ad68957a73c686cede64c92b44c500bec10c

SHA256
82756b540a33dc29fda4ba3182f86b3655ce5c0966a390353abab5693e343f91

SHA512
fc1c2eecf52208bbc093f4e243e50f5abc5bbe27fe252f872852168796b625318c73d003a06c7c91332e4a8e09c65335e383a9e8196fe94f4fcec59dd193823e

Download Submit
memory/3056-143-0x0000000002240000-0x000000000224C000-memory.dmp

Filesize
48KB

Download
memory/3056-139-0x0000000002230000-0x0000000002240000-memory.dmp

Filesize
64KB

Download
memory/3056-167-0x00000000026C0000-0x0000000002714000-memory.dmp

Filesize
336KB

Download
memory/3056-129-0x00000000021E0000-0x00000000021ED000-memory.dmp

Filesize
52KB

Download
memory/3056-168-0x0000000002720000-0x000000000272A000-memory.dmp

Filesize
40KB

Download
memory/3056-102-0x0000000000570000-0x000000000058A000-memory.dmp

Filesize
104KB

Download
memory/3056-154-0x00000000025C0000-0x0000000002624000-memory.dmp

Filesize
400KB

Download
memory/3056-162-0x0000000002670000-0x000000000268E000-memory.dmp

Filesize
120KB

Download
memory/3056-158-0x0000000002630000-0x0000000002665000-memory.dmp

Filesize
212KB

Download
memory/3056-107-0x00000000006D0000-0x00000000006E3000-memory.dmp

Filesize
76KB

Download
memory/3056-150-0x0000000002260000-0x000000000226D000-memory.dmp

Filesize
52KB

Download
memory/4492-0-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/4492-93-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download