Overview

overview

10

Static

static

3

12db7e01e0...18.exe

windows7-x64

10

12db7e01e0...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    100s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/10/2024, 09:55

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    12db7e01e0b6ebb6f80c6fcda43a2ba6_JaffaCakes118.exe

  • Size

    192KB

  • MD5

    12db7e01e0b6ebb6f80c6fcda43a2ba6

  • SHA1

    041e99415abed9968831583c37ccd7ac607db161

  • SHA256

    bb795222f07ff06ea6f86925fd6680789961c14db225092b364a5944afb77037

  • SHA512

    34d1aa38d38a35e431a50d8911c671700d79d83ee4e6d7e5134850df37949e2671f2a3605e7ec87f03af27945c64aeb1642156a4b153c157b1813101b8e7ac57

  • SSDEEP

    1536:i4cp2Oa9aaaaat031AdQWB5kCFrWszRUOHFlQhzyLwVKftfVBiZHAPloFp5A2mbJ:NOgW3kCFrWsF2eLbqx2F9Fs89x

Score
10/10
discoveryevasionpersistence

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 27 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\12db7e01e0b6ebb6f80c6fcda43a2ba6_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\12db7e01e0b6ebb6f80c6fcda43a2ba6_JaffaCakes118.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Checks computer location settings
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5080
    • C:\Users\Admin\nizer.exe
      "C:\Users\Admin\nizer.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:2300

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\nizer.exe
          Filesize

          192KB

          MD5

          8f2a45cfc3e0f7bb98598b82ae6b0cc6

          SHA1

          f25dc62a9b04253ac3f9644a03ed7870d22e206d

          SHA256

          305d89318912a36a307d406190708ebdb09ca6ca6e047c78f3b322279795bef9

          SHA512

          8687e9d5cb91cb4e4e9e7d484be091f1cae748ecc6211774f7727c086407167895ae70d397efea98fadd8ad0ae7ba549b3c399481cb7da498f8afefbcba908de

          Download Submit