Overview

overview

10

Static

static

3

ede8103338...18.exe

windows7-x64

10

ede8103338...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    102s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-09-2024 15:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ede8103338b9a5d04cc6bf85eff437ba_JaffaCakes118.exe

  • Size

    288KB

  • MD5

    ede8103338b9a5d04cc6bf85eff437ba

  • SHA1

    5307dc3f846d03a3133bca394a2cf5304c27d57f

  • SHA256

    658595871bab52fa2b3eb6bdab5080ca18ad8562d30f579404b5d8c7db12e3f9

  • SHA512

    691efb23698f160f80d150de4e609bedafb817c339e20fc15ec847f147dd04c08fecc2638e4de08c45aff7fcc0ed2de783361dd4b0b7b55072f0bcbb11e5b763

  • SSDEEP

    6144:4qlFUOAgjCbFak5GRuZzDkKn3RbxgT7VMa9YocgEBHBQZUNMhwlMbbWg3jtAD6OS:46UOPevlB9sZsuEBHBSWQkcnv

Score
10/10
discoveryevasionpersistence

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 52 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ede8103338b9a5d04cc6bf85eff437ba_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ede8103338b9a5d04cc6bf85eff437ba_JaffaCakes118.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Checks computer location settings
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3688
    • C:\Users\Admin\vauet.exe
      "C:\Users\Admin\vauet.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:2776

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\vauet.exe
    Filesize

    288KB

    MD5

    36f669b549d5f15cc710b3c01dab8e13

    SHA1

    558be464d534d961eb27e99c3d27006c183b0516

    SHA256

    c93509406a51e7229fa17374de700ba494b4762a425e5617de2fbaa58b09bc84

    SHA512

    98a849aa9231a6ce0221ce0d6db6032b27afe6afc92a17a0236a7c184409b7feb214aecde73f694a88d37df8ccc23d867ecb2c0cf35e0779b1d6283c58fc4e51

    Download Submit