Analysis
-
max time kernel
150s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
02/10/2024, 15:15
General
-
Target
0b513c899558f3c20d0632bb338e93a9_JaffaCakes118.exe
-
Size
381KB
-
MD5
0b513c899558f3c20d0632bb338e93a9
-
SHA1
8ef88ef498cdf2e788553d5ba9d74446b401686a
-
SHA256
5043e0219fe7597972d33a107e922472b1481f939212845dbcd4736c607e9365
-
SHA512
285900ec2a35e92ed6226570fa305d7958d91a713e3c9f8eaaeccec43cffefd90de4277ff9036fdfc0a41434f0b4423e38429f3de26b05de7496ee84ee9bad45
-
SSDEEP
6144:gBYWhG+OfpD9xBYxztRvFLwAKMcTQNRwMK+cVzNQwN/Qb9ATXtZuHz4cGttqbvUb:gDh5OfhiztR9LwARXP1CphOUsT4cc++
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b513c899558f3c20d0632bb338e93a9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0b513c899558f3c20d0632bb338e93a9_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rundlll.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rundlll.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
239KB
MD5b8d30262bfdc412a2eec305dc82ec6e2
SHA1f1359deb046a1f727fdf81dbcebac301c4ec2fd7
SHA2563fe6a874bfaf8d8f987cd17d29cd588246bf0cbe48b9af7049fa9cfa10bf4b46
SHA512bccac0639f24223fe0469379928816bad9609922bbe8e3242288c08160368b3d6e2beabaf4208cd62dc3b1c1e3a2faee3e702318636d0c0a3a81f7d6d48a8298
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
4KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
400KB