Overview

overview

7

Static

static

3

11a3605b0a...18.exe

windows7-x64

3

11a3605b0a...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/10/2024, 03:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    11a3605b0a8824f0ac114e4437a81bb0_JaffaCakes118.exe

  • Size

    176KB

  • MD5

    11a3605b0a8824f0ac114e4437a81bb0

  • SHA1

    2d0e1da34ca2b9212ef971fb16d6d7d70651c0dd

  • SHA256

    996a16c817c2fcae97d26aab937ca37e86d6ad841a5902f3a839f3f6421770c5

  • SHA512

    2b9a0dc9256ee528207e07d4b048e98fcfff49c78e523019bfd27ff49304bf93cdf94ad8141147f38a8ddb64cc76f2e268ed0883c99fd7bda8edb485544b687f

  • SSDEEP

    3072:eegyGlHONgZHzViqTO8XgaWi5Rg6Nn1rOkjby:kR5RganFOkjb

Score
7/10
discovery

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates processes with tasklist 1 TTPs 1 IoCs
    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\11a3605b0a8824f0ac114e4437a81bb0_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\11a3605b0a8824f0ac114e4437a81bb0_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2296
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c tasklist&&del 11a3605b0a8824f0ac114e4437a81bb0_JaffaCakes118.exe
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:32
      • C:\Windows\SysWOW64\tasklist.exe
        tasklist
        3⤵
        • Enumerates processes with tasklist
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:1532

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\zfcu.exe
          Filesize

          484B

          MD5

          abf6f6988eac187e52c1de269149408c

          SHA1

          a9b682757e424ab8e1ea1a1663939c21b44ead05

          SHA256

          57b8ee9574a102c5c51630c99a0a8db4fee2394a6942e785c0b6ffde496b4268

          SHA512

          02c41084e867dc35a38d060d917c613a19054b58c14101aaf816036b1cf0042fac90a681dea62702ede1f9338438a32ab1f3857f5a48027c271cb72e15d0c888

          Download Submit