Analysis

  • max time kernel
    93s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/10/2024, 03:52

General

  • Target

    11b8fb48549c91f7dc5b2d07898057fb_JaffaCakes118.exe

  • Size

    269KB

  • MD5

    11b8fb48549c91f7dc5b2d07898057fb

  • SHA1

    a6be4b146a81a5587b51b8536dbcf21595b91622

  • SHA256

    aa8af5a4029d3c47a23f6edb978f12cec63b189271b2363670ccc8a12a8f2c96

  • SHA512

    323263bd488e187a853134765dfa9b4e9a137ff57d05241a0b2b60988ddaf85dad0c3d89273943a38b492ebcfd92fbbb2350352c2a9e716ecca0b768e5e01dca

  • SSDEEP

    6144:tsaocyLC8mYpqyTyPd4QDoqKyyPP/Hms8oHjWkJh8CCLh:ttobHmYpqiy1jssKOs8CWkJaCC9

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Drops desktop.ini file(s) 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\11b8fb48549c91f7dc5b2d07898057fb_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\11b8fb48549c91f7dc5b2d07898057fb_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5068
    • C:\Users\Admin\AppData\Local\Temp\nszABA3.tmp\ins5.exe
      C:\Users\Admin\AppData\Local\Temp\nszABA3.tmp\ins5.exe 4fe0cf9f-1fe4-4abb-905a-57915bc06f2f.exe /t /dT131991738S /e5828005 /u4fe0cf9f-1fe4-4abb-905a-57915bc06f2f
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Drops desktop.ini file(s)
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1900
      • C:\Users\Admin\AppData\Local\Temp\nszABA3.tmp\4fe0cf9f-1fe4-4abb-905a-57915bc06f2f.exe
        "C:\Users\Admin\AppData\Local\Temp\nszABA3.tmp\4fe0cf9f-1fe4-4abb-905a-57915bc06f2f.exe" /t /dT131991738S /e5828005 /u4fe0cf9f-1fe4-4abb-905a-57915bc06f2f
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:3784

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nszABA3.tmp\4fe0cf9f-1fe4-4abb-905a-57915bc06f2f.exe

    Filesize

    250KB

    MD5

    035e4f28801f8a2f5c9a51750b1d8bc0

    SHA1

    6083a072e75b146941dc759796e1b539fd4846db

    SHA256

    46dd0dcd46ed04a5819e21810339dc160a28c6d77a12661549d4a6875c4312be

    SHA512

    b5f0b19672c425d5025411bb0bfb9f604723bf11ba0a04b202330d2675655e1b7cb31bd51314d77f000edb668307fcf9661e20d12238e2095961cb0b1277d945

  • C:\Users\Admin\AppData\Local\Temp\nszABA3.tmp\ins5.exe

    Filesize

    214KB

    MD5

    081f1ef743489a25c99fdd25f6d4f70d

    SHA1

    dfdbd1caf714644f6c1b1b383f717028c39a2db0

    SHA256

    ed6b25ef9345aa31303cdc1cad322b1607eda3bf7bfefe7445105baddd59c635

    SHA512

    bf2962affa9ffb92cbaa17389a71b6ecf548cf6629237444a4b078bdcbd29cdd825055e2fe49530053c864bb1ad42726c083bb7db6d20b0afc939363365ec4ca

  • C:\Users\Admin\AppData\Local\Temp\nszABA3.tmp\nsExec.dll

    Filesize

    8KB

    MD5

    249ae678f0dac4c625c6de6aca53823a

    SHA1

    6ac2b9e90e8445fed4c45c5dbf2d0227cd3b5201

    SHA256

    7298024a36310b7c4c112be87b61b62a0b1be493e2d5252a19e5e976daf674ce

    SHA512

    66e4081a40f3191bf28b810cf8411cb3c8c3e3ec5943e18d6672414fb5e7b4364f862cba44c9115c599ac90890ef02a773e254e7c979e930946bc52b0693aad7

  • memory/1900-32-0x0000000074882000-0x0000000074883000-memory.dmp

    Filesize

    4KB

  • memory/1900-9-0x0000000074882000-0x0000000074883000-memory.dmp

    Filesize

    4KB

  • memory/1900-10-0x0000000074880000-0x0000000074E31000-memory.dmp

    Filesize

    5.7MB

  • memory/1900-11-0x0000000074880000-0x0000000074E31000-memory.dmp

    Filesize

    5.7MB

  • memory/1900-37-0x0000000074880000-0x0000000074E31000-memory.dmp

    Filesize

    5.7MB

  • memory/1900-33-0x0000000074880000-0x0000000074E31000-memory.dmp

    Filesize

    5.7MB

  • memory/3784-26-0x0000000074880000-0x0000000074E31000-memory.dmp

    Filesize

    5.7MB

  • memory/3784-29-0x0000000074880000-0x0000000074E31000-memory.dmp

    Filesize

    5.7MB

  • memory/3784-30-0x0000000074880000-0x0000000074E31000-memory.dmp

    Filesize

    5.7MB

  • memory/3784-31-0x0000000074880000-0x0000000074E31000-memory.dmp

    Filesize

    5.7MB

  • memory/3784-28-0x0000000074880000-0x0000000074E31000-memory.dmp

    Filesize

    5.7MB

  • memory/3784-27-0x0000000074880000-0x0000000074E31000-memory.dmp

    Filesize

    5.7MB

  • memory/3784-35-0x0000000074880000-0x0000000074E31000-memory.dmp

    Filesize

    5.7MB

  • memory/3784-25-0x0000000074880000-0x0000000074E31000-memory.dmp

    Filesize

    5.7MB

  • memory/5068-41-0x0000000000400000-0x0000000000439000-memory.dmp

    Filesize

    228KB