Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
12/10/2024, 04:54
General
-
Target
387d98d62330295e80d0c96d4e55cce9_JaffaCakes118.exe
-
Size
3.3MB
-
MD5
387d98d62330295e80d0c96d4e55cce9
-
SHA1
d61a113135b8d6f4c596ca726a29472302f5c93c
-
SHA256
28fc8bbd885f07c09c5b723af53401a1e797bcf2cbe7adab372eb5acae560ba8
-
SHA512
8afd97a90349429ced0cbc08d07abd9f0371bf4e464915fa318b267d3add9b826a13862fe27c185b87ed90bfdb5883e0c921fa26d88d56db65135e9da3e213c3
-
SSDEEP
49152:32kvwVauXFeK9ES5qtu9Tnfd50sOHz51wveQHGxpbC48nqg0m02XMFjVAVz+Dfts:mdVLVe6JAETkF15Qwp78qg0m7XMdVAVz
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 21 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\387d98d62330295e80d0c96d4e55cce9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\387d98d62330295e80d0c96d4e55cce9_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-3KRSK.tmp\387d98d62330295e80d0c96d4e55cce9_JaffaCakes118.tmp"C:\Users\Admin\AppData\Local\Temp\is-3KRSK.tmp\387d98d62330295e80d0c96d4e55cce9_JaffaCakes118.tmp" /SL5="$9006E,3230053,54272,C:\Users\Admin\AppData\Local\Temp\387d98d62330295e80d0c96d4e55cce9_JaffaCakes118.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\PC Cleaner\Startw3i.exe"C:\Program Files (x86)\PC Cleaner\Startw3i.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
21.3MB
MD592de0a2d821debff7fb91ee0dbc88582
SHA137e4fd8b223d723372362b4fa05d59c3e06250e5
SHA25623d76ff82adebcf61dd54bf90e4283add6b7467323cd3edc707da9b4d6f7c0c5
SHA512b11df4c0c6bd7e9cd400c9d1dd1ee1b5436511ec3755998f28b0c1778336dcfb12c7a703ff779f213752e92fa1dd16cf72971fc7d7fff77c24dda3f8becc7465
-
Filesize
444KB
MD5456606941605bb68a5530b8a343c2e31
SHA18f85eeb9568e05ef0a6129d97d0d4a4165799257
SHA256ab68e794de947be033410a7f09239511253e53621de2ea94bd1f0df996a0d030
SHA512f4016f9f522e1c9d72aabfd177ed41507fd365e263f8eaeb50a0f53fedefaa9452d21c75d341cb10c169c605465fd109386fb88b9d3f0ad284b0baff7414e56b
-
Filesize
680KB
MD5ed69e64731547eba52476a2d2a2f7882
SHA1cbcd56bbb5230d11a01f18e9bf59f97802bb475b
SHA256427fa988a8a8c63393693ffeb61ddec195f000220ee55fd5112ec91682e933b0
SHA51204202de8dafb4c8964230d94eb44ad8ffd1d138b24f445aa3d707f4d9a9e9520d3d6f80cb0731ab9ebb7143011fe0d856d7e262d9672272876958d5e8ad55afe
-
Filesize
464KB
-
Filesize
464KB
-
Filesize
464KB
-
Filesize
464KB
-
Filesize
464KB
-
Filesize
464KB
-
Filesize
464KB
-
Filesize
464KB
-
Filesize
464KB
-
Filesize
464KB
-
Filesize
464KB
-
Filesize
464KB
-
Filesize
464KB
-
Filesize
744KB
-
Filesize
744KB
-
Filesize
744KB
-
Filesize
744KB
-
Filesize
744KB
-
Filesize
744KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
40KB