Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
31-10-2024 08:27
General
-
Target
8274a785c2b87dae0ac4a7230939b750_JaffaCakes118.exe
-
Size
9.1MB
-
MD5
8274a785c2b87dae0ac4a7230939b750
-
SHA1
860a222f3742a6b4f964eb6e89942f42d6d4202d
-
SHA256
6c9dc4bb94bc4ccaaf4c10f018a8528ba78e5a20273422e9d41935c9796a7b7e
-
SHA512
450d24afe1ea1f9887caafc25de41a9360208408977e8c1bd9e817386c73848211da427d14e05a21d316f58142f5297cb2ab3aed0e6e219cc9de2109cf937cdb
-
SSDEEP
196608:R6EzsdZINx4yXLQlG3JKjwKdELRiQSCKRXJgfi1zwR:wEzgsxdLZqw1slRi6NwR
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 23 IoCs
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8274a785c2b87dae0ac4a7230939b750_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8274a785c2b87dae0ac4a7230939b750_JaffaCakes118.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jkqug0u0.r0v\8274a785c2b87dae0ac4a7230939b750_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\jkqug0u0.r0v\8274a785c2b87dae0ac4a7230939b750_JaffaCakes118.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 18443⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
312B
MD5d4b49ac61a6cac139f96450777c10204
SHA192089d33442c9e2eaceac3ed8db6a7168f938e5a
SHA256807bdfa62a4312030c1ed54981674cff77f6108e6b4957754cabb810098ce082
SHA512eb13a0e7f0d4b44db7e8d0625ba1ee6a036083c39c24b85493d3ec9074ada03eb7003b97bd92ed5f2baaf26295a4690303332593c4776e75da5bc3b6adbc3ea6
-
Filesize
9.0MB
MD5d48ccb885cdbfa18c958b11342b55317
SHA1a323c08301a2ae1ade40a43d6760c093fd4cd66a
SHA25620f8a769028da75dd53a725927b0caa8d0b65c871f0b821e13c369b7feebccf0
SHA5123fde95413d86cbac63688ebfc41a65fb4e5a88c4c2ce3d24e2862aa5c1279615f297ffd215eedfcabdd20ac106cce435385bed3e843faf0eca2acec35458eca7
-
Filesize
14KB
MD5f5dbdcb5e6cd12bd75d87b882d00a73c
SHA18d40519eb0e1b10df7e78c02862d298b77607541
SHA256b9d8139cdb18c95f94d3ee4bba3547a1d33ab7df19139123ee3de22aea3ef3a4
SHA512da58a9aead3b0acc7c7d968edb3b9cd254f9bd01ded24558bb80e60194bbc37c59712eadd9cbf92aa1fd0dbdd79cbcad4fa769cea9e422dfbacacf0b76284fff
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
5.7MB