Analysis
-
max time kernel
142s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
21/09/2024, 12:11
General
-
Target
efc42e175a538761ca5dd54e75ec728a_JaffaCakes118.exe
-
Size
1.3MB
-
MD5
efc42e175a538761ca5dd54e75ec728a
-
SHA1
6935b1d26a5a34207aeb0d885dd4c6837bd754bb
-
SHA256
dc696166a1498d36a7312e72e5624ffc46a7c9dad1928a1fdc370ca4c2a281f9
-
SHA512
e23db782548fabfeba888abe663874c41083baddeb5fb3cc672858925abf9c0a9f63eabf2d1ceaa8a37d2b502015cd6b4e10143fe45d5175f70773189a211b63
-
SSDEEP
24576:85QIzHyuhiDyrPlS4gkwDrp4XAx+hwrywTEdoj:85p6iPYnpqAx+hMywTEdoj
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\efc42e175a538761ca5dd54e75ec728a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\efc42e175a538761ca5dd54e75ec728a_JaffaCakes118.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\12.exe"C:\Users\Admin\AppData\Local\Temp\12.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\EntSver.exeC:\Windows\EntSver.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
493KB
MD5bb98d4d382d80bd4795af979362c99d9
SHA1d61db6edbbfb72a4cc9d9e27717e58df6d26f406
SHA25613302c94a7764111f6e73219299d01760477062e43a65b29fd9d1b27db1793ff
SHA512da352dd73247f002050a8da578d21caec1b508057ef8031085d8f60881b0b299e327379a2da0df04157a19e549b8471ea347e327586bf4810570fc8b0f394128
-
Filesize
4KB
-
Filesize
592KB
-
Filesize
976KB
-
Filesize
268KB
-
Filesize
12KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
976KB
-
Filesize
268KB
-
Filesize
976KB
-
Filesize
976KB