Analysis
-
max time kernel
101s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
20-09-2024 21:48
General
-
Target
ee7c6a176aac201910ae09691fc21fea_JaffaCakes118.exe
-
Size
151KB
-
MD5
ee7c6a176aac201910ae09691fc21fea
-
SHA1
e803eaa95783f0c7d45044089eb1ed813a0ac0ff
-
SHA256
f2fe1675619eba55dadbea2aa661f467fdf311766bf7e4771082435c7a314b1c
-
SHA512
5b9a4b3130152d40c4eb5ad3eb884a18a08090f110157fb505e6dc44dcf3dd4351cacceae81bff792de5c3a60fd8c97d20f7ac8a8eb2be284481de7c7213dabf
-
SSDEEP
3072:6tkEoAWF4ZCD4OnYQqD841ZMImdKYRlBKgwtrlVw:6tkEoAM4iYQqA4fDmdKWHmro
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops autorun.inf file 1 TTPs 3 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in Program Files directory 1 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee7c6a176aac201910ae09691fc21fea_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ee7c6a176aac201910ae09691fc21fea_JaffaCakes118.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\Root\Office16\winword.exe"C:\Program Files\Microsoft Office\Root\Office16\winword.exe"2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3372 -s 7202⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 3372 -ip 33721⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
262KB
MD551d32ee5bc7ab811041f799652d26e04
SHA1412193006aa3ef19e0a57e16acf86b830993024a
SHA2566230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
SHA5125fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810
-
Filesize
1KB
MD5b7de42b44b92f199b65339b83d5087ab
SHA1876b76ecdaf217f32947e16f36651a192dbe116b
SHA256044946b677599cb780cb438d46a257aad7463341a1263cb1d5b9b166c4177c2f
SHA512ced82abf966604fbd7846692c8bf7aa36110decf97db03c5590685317b37b60aa5f9a45aa38a6fd2c5ed1d81e5e6e654268a7ee79acd0ba858a38bff96064f09
-
Filesize
126B
MD5163e20cbccefcdd42f46e43a94173c46
SHA14c7b5048e8608e2a75799e00ecf1bbb4773279ae
SHA2567780bee9df142a17e0457f3dcb2788b50fc2792370089335597d33719126fb7e
SHA512e5ac0ff6b087857799ab70f68067c9dc73eeb93ccfcad87047052380b95ade3e6eb2a7d01a0f850d548a39f4b1ebb60e299d603dbe25c31b9a3585b34a0c65a8
-
Filesize
151KB
MD5bb3f061b8e312cca142f9342000b000b
SHA17c032417ec541413caabfacbdff0df170dcad86a
SHA25624cb4bef078b831935352807ae4c4aaafd711e3d6aff28ea0935042d483858fb
SHA51230cd9d4ab6bb9443eb6d66b2e61347b5e74b14fcb489a2f38dfa04535af4fef6107547371644fee403313b2a8e64ee949f358b81c9e0997022ae32511f5712d8
-
Filesize
151KB
MD51168c71b44cdf8c59b16fc57384b8279
SHA1faa286df9b6faefca5051ded5f1c1105ab8c23b4
SHA2564dfb8715409b0322d303b6e0614f866dec3a1ef36e2763a103ecbdbc1f824d00
SHA512254cf2f11ab8ada12d05f7a719f32ee6b971c7619825a9096ce3ff4f30424b257db3cb70e2deb2bac2f29d7d9c3df49fb34d0b7a317c577b54bec8251f1c4949
-
Filesize
88KB
-
Filesize
88KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB