Overview

overview

10

Static

static

3

eea305b280...18.exe

windows7-x64

10

eea305b280...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-09-2024 23:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    eea305b2805d307df0557ef7fb2d9724_JaffaCakes118.exe

  • Size

    280KB

  • MD5

    eea305b2805d307df0557ef7fb2d9724

  • SHA1

    916fc2e57f404a0ad1f92b8dd51db8aef1337762

  • SHA256

    54bf6091e88d6f271a78f41aca9eb9fa201a1ae643103689db530056dd613925

  • SHA512

    d2bdff1aac0d975674f95363aba9ffd0ae11948d9808b19b578e230e1df5f59d671b303720a109ec31f5ce99953d3d3e7339711468785a667fe2f541fb72caa6

  • SSDEEP

    6144:KIXnIpydVsZyxyK5R8GYKi1Xfvs1tzH51t+ewSReXNc/W:BnuydfiebOiW

Score
10/10
discoveryevasionpersistence

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 52 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eea305b2805d307df0557ef7fb2d9724_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\eea305b2805d307df0557ef7fb2d9724_JaffaCakes118.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Checks computer location settings
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3652
    • C:\Users\Admin\weogio.exe
      "C:\Users\Admin\weogio.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:4252

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\weogio.exe
    Filesize

    280KB

    MD5

    c7b9b0a6f60092db50c926ca24d3d1f1

    SHA1

    3b998ee4bddf603b39ffbac0b713e1934b397043

    SHA256

    d92ab6cffa84831ced226d00bdc0f97aab3cabf6dbbf20dcdea9f0c97ab9ee82

    SHA512

    46cf307e2fbe04068e315467d1c736c796f316e20a1ca48eeb62ccd267b01ecdb529427866a3c63f2a1959f2685183ce5eb78e891e3ddbec22c6c13cd9b2592b

    Download Submit