Analysis
-
max time kernel
149s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
02-10-2024 01:15
General
-
Target
0835366c0a5d665d1521c21eb6a799c7_JaffaCakes118.exe
-
Size
1.7MB
-
MD5
0835366c0a5d665d1521c21eb6a799c7
-
SHA1
0bd318c46ece020119c99ba4114174bcdf53119d
-
SHA256
b96420c807044297b54212a4fa9b1256dc8b21eadf938a2cb9ec64370df60255
-
SHA512
f2b0df00bb879d2d0531b033d9a559c7e3fd3e193407583c72778299f5296800beef9ea97997c1e34dfe177dc95bb3af0f1ab4677a0a841da4545ffc26b14c7a
-
SSDEEP
49152:j9A0F15M0lph/x2A9XObbNDJ0IR807LMCIoRz2n1xRaq+:ZA0La0lfM8exl/R80fPVxq+
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 18 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 11 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 19 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0835366c0a5d665d1521c21eb6a799c7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0835366c0a5d665d1521c21eb6a799c7_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-RCEFO.tmp\0835366c0a5d665d1521c21eb6a799c7_JaffaCakes118.tmp"C:\Users\Admin\AppData\Local\Temp\is-RCEFO.tmp\0835366c0a5d665d1521c21eb6a799c7_JaffaCakes118.tmp" /SL5="$B0054,1407146,214016,C:\Users\Admin\AppData\Local\Temp\0835366c0a5d665d1521c21eb6a799c7_JaffaCakes118.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\basic-launcher-scite\Sc355.exe"C:\Program Files (x86)\basic-launcher-scite\Sc355.exe" "C:\Program Files (x86)\basic-launcher-scite\basiclauncher.bas"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1420,i,11708048364682646792,608099842549576907,262144 --variations-seed-version --mojo-platform-channel-handle=1020 /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
750KB
MD547cd33a236a022504b5d2d5b2ceecb26
SHA1fb3e058f428afbc00765069843fc02120a52bf41
SHA256695fe3299469034356a45bd2ce854aa361b0beffca511f5a46cb606c19fef7fb
SHA51266d615dc977ab7fb54e5c37b0d0f742378c84078e9eed25120e78cc3bb2dd7b96855e8f4c6fe5ae7547d96a8c3a4248a1fa243db7c2f9e9e410f7608d62bb6f5
-
Filesize
15KB
MD563729f492e322f5cb14378d23efd1071
SHA1eafd4ccff03f2476c23ad9d1e5b828fb057bd42a
SHA25658dd24368053e92064454502bdf4b6c6d1191a096dee8c5e396c73b585b94f10
SHA5125c16734f390c1ca0fd9a79a9606f9cae9d7b6480f9e4abf98a497ccc8db4e41d63a019ceecff8ef05746956edc740c8fbc0d51d094653d66a610210b9d9b95f4
-
Filesize
2KB
MD5355a4f057fd60b692722e72b695cd44a
SHA1674f5673c0016bd24b29fc4b50a5ca46922a497b
SHA256dd6f3f8d2a59f3d9f973c94378957880f233847e9be61a8760931b2f25eb1460
SHA51235dbb4a12028f1d966cd681dbeac5b830812548f62d2a393cf9eabafa68f88ba2e68d14955079993f34cdf92634715f5365a85a5ca7decbe88957cabf583204c
-
Filesize
9KB
MD540eac7907b90e5d7425618312353a542
SHA1a4716705a7af520f0d5475642ce793b15b08b617
SHA2563b04e926bff97823ea635ad617526b5b06b48c68ad6de0b2bf1c3c1fa0f90585
SHA512b4ab5ed1f4c59973d82533202e31615daf79bb0ac3df0b5e7018b80f398160abbc9e2c2c0e8201a77498537a541d27e955afe455b5218cabe81cf839d2d9b869
-
Filesize
845KB
MD5de18910e6bfe9b3b0f5612122f3f26ba
SHA12a78b75a87a4bf8ebfba5471474b5c5b166b229d
SHA256c1466adea5183028acd8e936b06ff3faa74f669917ad76ba623311ca75971ec7
SHA51242ee45a01e718ff52e04cd438868f185e93b09ebd8f314d1033d160552b2ff3faa51f0772e3d71cb1bf4f80542aed3f19cb944a67801411df557b103dc6c3ee3
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
236KB
-
Filesize
40KB
-
Filesize
236KB
-
Filesize
236KB
-
Filesize
912KB
-
Filesize
912KB
-
Filesize
912KB
-
Filesize
912KB
-
Filesize
912KB
-
Filesize
912KB