Overview

overview

10

Static

static

3

06e205e35f...18.exe

windows7-x64

10

06e205e35f...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    98s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-10-2024 18:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    06e205e35f29fca28202c811a601c5f0_JaffaCakes118.exe

  • Size

    100KB

  • MD5

    06e205e35f29fca28202c811a601c5f0

  • SHA1

    553095ece5b562057fe49a623398ba1824ebf189

  • SHA256

    15640c854eea22e6b4dec7a8ccef04d4f84542d37f95e0a116623a067f5e9848

  • SHA512

    cf6a9a4b9b416ac1f33960991d65ce94f9b68bbbba9906593934802babc6b47a81163095d46ba3b37e045b4e24e2c3178e5944374cbb3b47be94129d93c6d40a

  • SSDEEP

    1536:RTt0L82NTdw3K8rLGZcYADZPU1+73BD88b0ny7NIjnZMd:Cw3fWgZPUQJ7Cned

Score
10/10
discoveryevasionpersistence

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 51 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\06e205e35f29fca28202c811a601c5f0_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\06e205e35f29fca28202c811a601c5f0_JaffaCakes118.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Checks computer location settings
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4120
    • C:\Users\Admin\raiuhiv.exe
      "C:\Users\Admin\raiuhiv.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:3864

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\raiuhiv.exe
    Filesize

    100KB

    MD5

    83684820625e208186f607b81754cf27

    SHA1

    79fc69765808adc89d781df2d90af7a72831f215

    SHA256

    93adc7b8314b191cf17f520d02c28aede544071bbd87d4ffca5590a87fcb0977

    SHA512

    a163cad7764ccda069fe096b9838555ffe16794158901dc03484a8c5f9f59fe223b158cac05f3b6a878ca74be42d99db1b7e3e0946e242a8f159c113e47455ec

    Download Submit