Overview

overview

10

Static

static

3

3fb960c66b...18.exe

windows7-x64

10

3fb960c66b...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    96s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/10/2024, 11:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3fb960c66b86788d2051f7adb92d1467_JaffaCakes118.exe

  • Size

    124KB

  • MD5

    3fb960c66b86788d2051f7adb92d1467

  • SHA1

    2a7b0dd5393030d20103a25057ebd1c749f70bef

  • SHA256

    d06ba1dbbc84cc46d22b5d604ed4b50d52e22b4fb3ab93daca707e5a0ece72bb

  • SHA512

    c7c112552f9e59f1ccc2621df28ccbf9a8e8fa3a8405d20cab617f868cc60b732e0b453021c1e668b5baf93672b3d9d252f7628a9c85a23a965dc28fe214adfd

  • SSDEEP

    1536:0KtkjATQDU0GgAJa0P1kNmKldCMhdu8KWP/nTn8nBP9VeUoPNeG0h/:dkjHDU0GgAT9xoI

Score
10/10
discoveryevasionpersistence

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 51 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3fb960c66b86788d2051f7adb92d1467_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\3fb960c66b86788d2051f7adb92d1467_JaffaCakes118.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Checks computer location settings
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1388
    • C:\Users\Admin\daeuc.exe
      "C:\Users\Admin\daeuc.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:3384

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\daeuc.exe
    Filesize

    124KB

    MD5

    7fce0b3fd31a7b0a4a3d1ad2d7b33cb5

    SHA1

    99eb4a7bf8ffa97d99d075aba067b392e1151dce

    SHA256

    ae36a1856a45ae0a7eb57df08eec5fb3c91feeef2a972b0c890ef2e2a5947abe

    SHA512

    90fb7b8f3680ab3cc54ad96c7e0fc90f89403003a60e8ecb5f41bcc1f5c67bef9ab2564ee9b9064711fc8bf9a7fb300d1f75f335ef7167f50517c7c2dabe1860

    Download Submit