647840b0c745bb5d9ef481038b6f45f2eda25f8483bbfea733fe7adac03c7455

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20/09/2024, 06:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ed0d6dd06661db39631a957f9ebd3c4c_JaffaCakes118.exe
Size

188KB
MD5

ed0d6dd06661db39631a957f9ebd3c4c
SHA1

e847c151d71e169cbf9f83c93a18bfe5f9c3a6d5
SHA256

647840b0c745bb5d9ef481038b6f45f2eda25f8483bbfea733fe7adac03c7455
SHA512

c6e1740a492d6ebcd99756504e4e452af8711f8aba2d080bcac2ee2e808540624538222eeff6e89086222df57e5f819b90501e15aceee3a898f505d93aa20d24
SSDEEP

3072:pmwFa2NYyJ30qzzhKL6AO00K563RXBXBbourVRPDyrt:phbDzs595chJBbourVRP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	ed0d6dd06661db39631a957f9ebd3c4c_JaffaCakes118.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\photo01.exe:Zone.Identifier	ed0d6dd06661db39631a957f9ebd3c4c_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ed0d6dd06661db39631a957f9ebd3c4c_JaffaCakes118.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	ed0d6dd06661db39631a957f9ebd3c4c_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings	ed0d6dd06661db39631a957f9ebd3c4c_JaffaCakes118.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\photo01.exe:Zone.Identifier	ed0d6dd06661db39631a957f9ebd3c4c_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3904	ed0d6dd06661db39631a957f9ebd3c4c_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\ed0d6dd06661db39631a957f9ebd3c4c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ed0d6dd06661db39631a957f9ebd3c4c_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Subvert Trust Controls: Mark-of-the-Web Bypass
- System Location Discovery: System Language Discovery
- Modifies registry class
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\photo01.exe

Filesize
163KB

MD5
5042e637a61f374960f8d94dd121c1cd

SHA1
c3ad97167e820d5b6d7815fe01f995ba37b1ce6f

SHA256
b534d46182ca8c02df34cc1b96fac3c500c7d4c0fab1f4b1fb81cafee32e9437

SHA512
6e9c9afbcd8233e2fd8290e3f8c655ffe6dcbf0a1d88d33d2b94feab06a21ddc3551274d4517796390a052a1a4dafefca056ec1221824dc13721122b2c1c6ef8

Download Submit