Analysis
-
max time kernel
94s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02/10/2024, 18:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0be52a0e53076b6a661d64f5d12cee35_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
0be52a0e53076b6a661d64f5d12cee35_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
0be52a0e53076b6a661d64f5d12cee35_JaffaCakes118.exe
-
Size
499KB
-
MD5
0be52a0e53076b6a661d64f5d12cee35
-
SHA1
884271d87366b7162c9168cf892b4187ae2b86d1
-
SHA256
ad706b63fc22d24b22fc2255405d2ce1ae5be72c628ff6a27795288e20e75189
-
SHA512
83072a4efb252c3fce2d0dbfa5e0a82572b4bb67ed01dddf1ada8af140649a2338c22fea00ca6d4b2eb7fe4c8ff2ea0d32c5f98b15c7a4364456506f6e610762
-
SSDEEP
12288:PU9XiuicaV5nmcFj94xYWqiiZB0ABi5Fl5NiSMu3AC0:PUdHCmCj9hjieBCFluSrP0
Score
6/10
Malware Config
Signatures
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\wWw.VoLamViet.Net\VulanProF605_CR\VulanProF605_CR\MAPS\BaLangHuyen.map 0be52a0e53076b6a661d64f5d12cee35_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\wWw.VoLamViet.Net\VulanProF605_CR\VulanProF605_CR\Profiles\10_default.cfg 0be52a0e53076b6a661d64f5d12cee35_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\wWw.VoLamViet.Net\VulanProF605_CR\VulanProF605_CR\Profiles\7_default.cfg 0be52a0e53076b6a661d64f5d12cee35_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\wWw.VoLamViet.Net\VulanProF605_CR\VulanProF605_CR\Profiles\141_default.cfg 0be52a0e53076b6a661d64f5d12cee35_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\wWw.VoLamViet.Net\VulanProF605_CR\VulanProF605_CR\Profiles\168_default.cfg 0be52a0e53076b6a661d64f5d12cee35_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\wWw.VoLamViet.Net\VulanProF605_CR\VulanProF605_CR\Profiles\170_default.cfg 0be52a0e53076b6a661d64f5d12cee35_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\wWw.VoLamViet.Net\VulanProF605_CR\VulanProF605_CR\VulanProF.exe 0be52a0e53076b6a661d64f5d12cee35_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\wWw.VoLamViet.Net\VulanProF605_CR\VulanProF605_CR\MAPS\ChuTienTran.map 0be52a0e53076b6a661d64f5d12cee35_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\wWw.VoLamViet.Net\VulanProF605_CR\VulanProF605_CR\Profiles\120_default.cfg 0be52a0e53076b6a661d64f5d12cee35_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\wWw.VoLamViet.Net\VulanProF605_CR\VulanProF605_CR\Profiles\91_default.cfg 0be52a0e53076b6a661d64f5d12cee35_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\wWw.VoLamViet.Net\VulanProF605_CR\VulanProF605_CR\Profiles\39_default.cfg 0be52a0e53076b6a661d64f5d12cee35_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\wWw.VoLamViet.Net\VulanProF605_CR\VulanProF605_CR\TOADO\HacSaDong_nhatrac.sps 0be52a0e53076b6a661d64f5d12cee35_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\wWw.VoLamViet.Net\VulanProF605_CR\VulanProF605_CR\VulanPro.ini 0be52a0e53076b6a661d64f5d12cee35_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\wWw.VoLamViet.Net\VulanProF605_CR\VulanProF605_CR\Profiles\171_default.cfg 0be52a0e53076b6a661d64f5d12cee35_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\wWw.VoLamViet.Net\VulanProF605_CR\VulanProF605_CR\Profiles\202_default.cfg 0be52a0e53076b6a661d64f5d12cee35_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\wWw.VoLamViet.Net\VulanProF605_CR\VulanProF605_CR\MAPS\ThachCoTran.map 0be52a0e53076b6a661d64f5d12cee35_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\wWw.VoLamViet.Net\VulanProF605_CR\VulanProF605_CR\Profiles\135_default.cfg 0be52a0e53076b6a661d64f5d12cee35_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\wWw.VoLamViet.Net\VulanProF605_CR\VulanProF605_CR\Profiles\320_default.cfg 0be52a0e53076b6a661d64f5d12cee35_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\wWw.VoLamViet.Net\VulanProF605_CR\VulanProF605_CR\Profiles\75_default.cfg 0be52a0e53076b6a661d64f5d12cee35_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\wWw.VoLamViet.Net\VulanProF605_CR\VulanProF605_CR\Profiles\77_default.cfg 0be52a0e53076b6a661d64f5d12cee35_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\wWw.VoLamViet.Net\VulanProF605_CR\VulanProF605_CR\MAPS\DaiLy.map 0be52a0e53076b6a661d64f5d12cee35_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\wWw.VoLamViet.Net\VulanProF605_CR\VulanProF605_CR\Profiles\199_default.cfg 0be52a0e53076b6a661d64f5d12cee35_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\wWw.VoLamViet.Net\VulanProF605_CR\VulanProF605_CR\Profiles\1_default.cfg 0be52a0e53076b6a661d64f5d12cee35_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\wWw.VoLamViet.Net\VulanProF605_CR\VulanProF605_CR\Profiles\74_default.cfg 0be52a0e53076b6a661d64f5d12cee35_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\wWw.VoLamViet.Net\VulanProF605_CR\VulanProF605_CR\Profiles\8_default.cfg 0be52a0e53076b6a661d64f5d12cee35_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\wWw.VoLamViet.Net\VulanProF605_CR\VulanProF605_CR\TOADO\HacSaDong_nhatrac.tps 0be52a0e53076b6a661d64f5d12cee35_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\wWw.VoLamViet.Net\VulanProF605_CR\VulanProF605_CR\Licenses\GF_ST380215AS5RX17ZXR.lic 0be52a0e53076b6a661d64f5d12cee35_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\wWw.VoLamViet.Net\VulanProF605_CR\VulanProF605_CR\MAPS\SaMacSonDong1.map 0be52a0e53076b6a661d64f5d12cee35_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\wWw.VoLamViet.Net\VulanProF605_CR\VulanProF605_CR\Profiles\225_default.cfg 0be52a0e53076b6a661d64f5d12cee35_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\wWw.VoLamViet.Net\VulanProF605_CR\VulanProF605_CR\MAPS\LongMonTran.map 0be52a0e53076b6a661d64f5d12cee35_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\wWw.VoLamViet.Net\VulanProF605_CR\VulanProF605_CR\Profiles\21_default.cfg 0be52a0e53076b6a661d64f5d12cee35_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\wWw.VoLamViet.Net\VulanProF605_CR\VulanProF605_CR\Ohm_VL.dll 0be52a0e53076b6a661d64f5d12cee35_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\wWw.VoLamViet.Net\VulanProF605_CR\VulanProF605_CR\Profiles\122_default.cfg 0be52a0e53076b6a661d64f5d12cee35_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\wWw.VoLamViet.Net\VulanProF605_CR\VulanProF605_CR\Profiles\143_default.cfg 0be52a0e53076b6a661d64f5d12cee35_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\wWw.VoLamViet.Net\VulanProF605_CR\VulanProF605_CR\Profiles\181_default.cfg 0be52a0e53076b6a661d64f5d12cee35_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\wWw.VoLamViet.Net\VulanProF605_CR\VulanProF605_CR\Profiles\23_default.cfg 0be52a0e53076b6a661d64f5d12cee35_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\wWw.VoLamViet.Net\VulanProF605_CR\VulanProF605_CR\TOADO\SMDB.sps 0be52a0e53076b6a661d64f5d12cee35_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\wWw.VoLamViet.Net\VulanProF605_CR\VulanProF605_CR\VulanHookProF.dll 0be52a0e53076b6a661d64f5d12cee35_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\wWw.VoLamViet.Net\VulanProF605_CR\VulanProF605_CR\MAPS\SaMacSonDong3.map 0be52a0e53076b6a661d64f5d12cee35_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\wWw.VoLamViet.Net\VulanProF605_CR\VulanProF605_CR\Profiles\321_default.cfg 0be52a0e53076b6a661d64f5d12cee35_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\wWw.VoLamViet.Net\VulanProF605_CR\VulanProF605_CR\Profiles\66_default.cfg 0be52a0e53076b6a661d64f5d12cee35_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\wWw.VoLamViet.Net\VulanProF605_CR\VulanProF605_CR\Profiles\90_default.cfg 0be52a0e53076b6a661d64f5d12cee35_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\wWw.VoLamViet.Net\VulanProF605_CR\VulanProF605_CR\Profiles\55_default.cfg 0be52a0e53076b6a661d64f5d12cee35_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\wWw.VoLamViet.Net\VulanProF605_CR\VulanProF605_CR\MAPS\DaoHuongThon.map 0be52a0e53076b6a661d64f5d12cee35_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\wWw.VoLamViet.Net\VulanProF605_CR\VulanProF605_CR\Profiles\172_default.cfg 0be52a0e53076b6a661d64f5d12cee35_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\wWw.VoLamViet.Net\VulanProF605_CR\VulanProF605_CR\Profiles\204_default.cfg 0be52a0e53076b6a661d64f5d12cee35_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\wWw.VoLamViet.Net\VulanProF605_CR\VulanProF605_CR\Profiles\78_default.cfg 0be52a0e53076b6a661d64f5d12cee35_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\wWw.VoLamViet.Net\VulanProF605_CR\VulanProF605_CR\TOADO\SMBD.tps 0be52a0e53076b6a661d64f5d12cee35_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\wWw.VoLamViet.Net\VulanProF605_CR\VulanProF605_CR\MAPS\GiangTanThon.map 0be52a0e53076b6a661d64f5d12cee35_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\wWw.VoLamViet.Net\VulanProF605_CR\VulanProF605_CR\Profiles\6_default.cfg 0be52a0e53076b6a661d64f5d12cee35_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\wWw.VoLamViet.Net\VulanProF605_CR\VulanProF605_CR\Profiles\83_default.cfg 0be52a0e53076b6a661d64f5d12cee35_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\wWw.VoLamViet.Net\VulanProF605_CR\VulanProF605_CR\MAPS\maplist.ini 0be52a0e53076b6a661d64f5d12cee35_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\wWw.VoLamViet.Net\VulanProF605_CR\VulanProF605_CR\Profiles\73_default.cfg 0be52a0e53076b6a661d64f5d12cee35_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\wWw.VoLamViet.Net\VulanProF605_CR\Uninstall.exe 0be52a0e53076b6a661d64f5d12cee35_JaffaCakes118.exe File created C:\Program Files (x86)\wWw.VoLamViet.Net\VulanProF605_CR\Uninstall.ini 0be52a0e53076b6a661d64f5d12cee35_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\wWw.VoLamViet.Net\VulanProF605_CR\VulanProF605_CR\Profiles\203_default.cfg 0be52a0e53076b6a661d64f5d12cee35_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\wWw.VoLamViet.Net\VulanProF605_CR\VulanProF605_CR\Profiles\167_default.cfg 0be52a0e53076b6a661d64f5d12cee35_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\wWw.VoLamViet.Net\VulanProF605_CR\VulanProF605_CR\MAPS\BangHoi.map 0be52a0e53076b6a661d64f5d12cee35_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\wWw.VoLamViet.Net\VulanProF605_CR\VulanProF605_CR\MAPS\ChuTienTran (khong qua cau so 1).map 0be52a0e53076b6a661d64f5d12cee35_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\wWw.VoLamViet.Net\VulanProF605_CR\VulanProF605_CR\MAPS\TuongDuong.map 0be52a0e53076b6a661d64f5d12cee35_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\wWw.VoLamViet.Net\VulanProF605_CR\VulanProF605_CR\Profiles\101_default.cfg 0be52a0e53076b6a661d64f5d12cee35_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\wWw.VoLamViet.Net\VulanProF605_CR\VulanProF605_CR\Profiles\124_default.cfg 0be52a0e53076b6a661d64f5d12cee35_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\wWw.VoLamViet.Net\VulanProF605_CR\VulanProF605_CR\Profiles\136_default.cfg 0be52a0e53076b6a661d64f5d12cee35_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\wWw.VoLamViet.Net\VulanProF605_CR\VulanProF605_CR\Profiles\163_default.cfg 0be52a0e53076b6a661d64f5d12cee35_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0be52a0e53076b6a661d64f5d12cee35_JaffaCakes118.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
172KB
MD5a01621a3b7454240e39e8241332277b4
SHA1a030881ab5aee8b6c99e40c12645c5423235f160
SHA25617fe1b221b400cb6195ce94c1da587835d6d1043f3b063f264203726e4d7f2a3
SHA5124f88ea5922bad30654b40a569e42474895579ee727ed00fb5ae99bac36a6c217a6db289a87f50f669e17834e39a1372273f3160b8942c101c0bfcd6a790eea27