Overview

overview

10

Static

static

3

ecf8721453...18.exe

windows7-x64

10

ecf8721453...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    96s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/09/2024, 05:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ecf872145315b86a86d93f98ab852f9c_JaffaCakes118.exe

  • Size

    152KB

  • MD5

    ecf872145315b86a86d93f98ab852f9c

  • SHA1

    efe194472d4cb773d0001c2f04daffa6ee79486a

  • SHA256

    f0ec15220164af0d0eec9b4fd1044ae4592e32746071275bd94c99b1ccc58d89

  • SHA512

    5985c212f6e279a9b3549e335d8433b961dce3771e73c6d38c0aa96423d8591915e89bfc8468a8d3f93c650fb686cfaa4c14bd4a2cb459af72357985998fa84d

  • SSDEEP

    3072:15EGIHCzwrCaHHvhtbz0wXtV2eZDEUXni7fo7KSif8xWM33r3k1jTCZX+E5j4oQ:MG+CzwrCW/0AHa8nuo7KSif8xWM33r3B

Score
10/10
discoveryevasionpersistence

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 51 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ecf872145315b86a86d93f98ab852f9c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ecf872145315b86a86d93f98ab852f9c_JaffaCakes118.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Checks computer location settings
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4004
    • C:\Users\Admin\hiobuf.exe
      "C:\Users\Admin\hiobuf.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:3432

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\hiobuf.exe
    Filesize

    152KB

    MD5

    e78831ca7d4bfce7c69f75c56e5d72ef

    SHA1

    718b4a3927a391248ae1fad646118a6b05276d44

    SHA256

    6ea342754b7934d2a94e83823756dd5c380c239d421d81b4f04cc7279e72e086

    SHA512

    e6f00f6b45974e81c32c79f5711f206fe72cf372ccdac00d5ae9f52759b6bf68487883076a148254a6af5fa202ffc97e01748f09733e4440d4e0f9a34b37030f

    Download Submit