Analysis

  • max time kernel
    140s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/10/2024, 21:06

General

  • Target

    4f07f680176fd270e11e175614d590e9_JaffaCakes118.exe

  • Size

    187KB

  • MD5

    4f07f680176fd270e11e175614d590e9

  • SHA1

    c1afef4bd8eace84c8ffca1c2c4afb8636ddf12e

  • SHA256

    f2967a77251732f2472f8063692f5c126125dd5386a62a1a130d6b35c7a3729f

  • SHA512

    5b2046b420987f6e0296687347379fab3117fe1331e72bcb551b43ea3e28c60f942ed9de233891549d3dd4479021bb768d38c396c946336449dc3058e7efa604

  • SSDEEP

    3072:XB4N5tlfILPZJUaFPmgRMNlPTGQQm6ytwZEsrYkK4cuUgW693fCHQW:R4LmLf98gWNlPTGQQm6agrdu+f

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4f07f680176fd270e11e175614d590e9_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\4f07f680176fd270e11e175614d590e9_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2344
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sysremove.bat" "
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1064
    • C:\Windows\SysWOW64\disvc.exe
      "C:\Windows\system32\disvc.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      PID:5044

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\sysremove.bat

          Filesize

          313B

          MD5

          159dfc836a06544da98ef7e74951a258

          SHA1

          647aefe97c3fea310cfa33bd098d41d54d6f1edb

          SHA256

          bec73991d0a6a300ffe77ef60ae75a182371c4e1f162d7d9b04654ceb0901779

          SHA512

          fb6a6e64587da77277b19eeef35893be51df52ef3f4ecbef7941209b05b383c8816c893e31f575fb2d32a9f89fd84a645a8b39728670447aa91ed306e1ac7002

        • C:\Windows\SysWOW64\disvc.exe

          Filesize

          187KB

          MD5

          4f07f680176fd270e11e175614d590e9

          SHA1

          c1afef4bd8eace84c8ffca1c2c4afb8636ddf12e

          SHA256

          f2967a77251732f2472f8063692f5c126125dd5386a62a1a130d6b35c7a3729f

          SHA512

          5b2046b420987f6e0296687347379fab3117fe1331e72bcb551b43ea3e28c60f942ed9de233891549d3dd4479021bb768d38c396c946336449dc3058e7efa604

        • memory/2344-5-0x0000000000B90000-0x0000000000B91000-memory.dmp

          Filesize

          4KB

        • memory/2344-12-0x00000000022D0000-0x00000000022D1000-memory.dmp

          Filesize

          4KB

        • memory/2344-4-0x0000000000500000-0x0000000000501000-memory.dmp

          Filesize

          4KB

        • memory/2344-3-0x0000000000510000-0x0000000000511000-memory.dmp

          Filesize

          4KB

        • memory/2344-8-0x0000000002350000-0x0000000002351000-memory.dmp

          Filesize

          4KB

        • memory/2344-7-0x00000000022E0000-0x00000000022E8000-memory.dmp

          Filesize

          32KB

        • memory/2344-0-0x0000000000400000-0x000000000047F000-memory.dmp

          Filesize

          508KB

        • memory/2344-2-0x00000000006E0000-0x00000000006E1000-memory.dmp

          Filesize

          4KB

        • memory/2344-13-0x0000000002330000-0x0000000002331000-memory.dmp

          Filesize

          4KB

        • memory/2344-1-0x0000000000620000-0x0000000000663000-memory.dmp

          Filesize

          268KB

        • memory/2344-15-0x0000000002310000-0x0000000002311000-memory.dmp

          Filesize

          4KB

        • memory/2344-14-0x0000000002320000-0x0000000002321000-memory.dmp

          Filesize

          4KB

        • memory/2344-10-0x0000000002300000-0x0000000002301000-memory.dmp

          Filesize

          4KB

        • memory/2344-11-0x0000000000BA0000-0x0000000000BA1000-memory.dmp

          Filesize

          4KB

        • memory/2344-6-0x00000000022F0000-0x00000000022F2000-memory.dmp

          Filesize

          8KB

        • memory/2344-9-0x0000000002360000-0x0000000002361000-memory.dmp

          Filesize

          4KB

        • memory/2344-28-0x0000000000620000-0x0000000000663000-memory.dmp

          Filesize

          268KB

        • memory/2344-25-0x0000000000400000-0x000000000047F000-memory.dmp

          Filesize

          508KB

        • memory/5044-29-0x00000000023A0000-0x00000000023A1000-memory.dmp

          Filesize

          4KB

        • memory/5044-30-0x00000000023B0000-0x00000000023B1000-memory.dmp

          Filesize

          4KB

        • memory/5044-24-0x0000000000820000-0x0000000000863000-memory.dmp

          Filesize

          268KB

        • memory/5044-34-0x0000000002360000-0x0000000002361000-memory.dmp

          Filesize

          4KB

        • memory/5044-26-0x0000000002330000-0x0000000002338000-memory.dmp

          Filesize

          32KB

        • memory/5044-33-0x0000000002370000-0x0000000002371000-memory.dmp

          Filesize

          4KB

        • memory/5044-32-0x0000000002380000-0x0000000002381000-memory.dmp

          Filesize

          4KB

        • memory/5044-31-0x0000000002350000-0x0000000002351000-memory.dmp

          Filesize

          4KB

        • memory/5044-36-0x0000000000400000-0x000000000047F000-memory.dmp

          Filesize

          508KB

        • memory/5044-37-0x0000000000820000-0x0000000000863000-memory.dmp

          Filesize

          268KB

        • memory/5044-39-0x0000000000400000-0x000000000047F000-memory.dmp

          Filesize

          508KB

        • memory/5044-40-0x0000000000820000-0x0000000000863000-memory.dmp

          Filesize

          268KB