Analysis
-
max time kernel
74s -
max time network
77s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
20-09-2024 20:47
General
-
Target
ee655298386a87abb02860e9aff3a1d1_JaffaCakes118.exe
-
Size
313KB
-
MD5
ee655298386a87abb02860e9aff3a1d1
-
SHA1
3c4731ac7a563bbb3f0d0ff83e662b0a1d6092c1
-
SHA256
76d38234c0aa2692418edd02ab9ade3f79ba3ef84fd753385ba414e429329c23
-
SHA512
282405d2faff65ba06a476743ceb36d1879b0c2c929af3af71201ec13bac1bca13848c79cc91cffd64a0ec0258bae13edc6f62af98e986ce4700811189b5d59f
-
SSDEEP
6144:LFOztnVeEta0etzIcaM++/F8waJgIiFxqkcEHWWHQCLOsY8NDWczyOIipvxVKnzl:LFOztnAEs0etbaMv/+Wf
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Unexpected DNS network traffic destination 54 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 16 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee655298386a87abb02860e9aff3a1d1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ee655298386a87abb02860e9aff3a1d1_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\DE25E01C-A553-C0F0-1FF2-A9F4C346ED68\A7B0F190-DA75-71CB-1CCB-AE35102FC239.exeC:\Users\Admin\AppData\Roaming\DE25E01C-A553-C0F0-1FF2-A9F4C346ED68\A7B0F190-DA75-71CB-1CCB-AE35102FC239.exe C:\Users\Admin\AppData\Local\Temp\ee655298386a87abb02860e9aff3a1d1_jaffacakes118.exe2⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
313KB
MD5ee655298386a87abb02860e9aff3a1d1
SHA13c4731ac7a563bbb3f0d0ff83e662b0a1d6092c1
SHA25676d38234c0aa2692418edd02ab9ade3f79ba3ef84fd753385ba414e429329c23
SHA512282405d2faff65ba06a476743ceb36d1879b0c2c929af3af71201ec13bac1bca13848c79cc91cffd64a0ec0258bae13edc6f62af98e986ce4700811189b5d59f
-
Filesize
220KB
-
Filesize
220KB
-
Filesize
4KB
-
Filesize
220KB
-
Filesize
220KB
-
Filesize
220KB
-
Filesize
4KB
-
Filesize
220KB
-
Filesize
220KB
-
Filesize
220KB
-
Filesize
4KB
-
Filesize
220KB
-
Filesize
220KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
196KB
-
Filesize
412KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
4KB
-
Filesize
412KB
-
Filesize
144KB
-
Filesize
412KB