Overview
overview
10Static
static
10JaffaCakes...6d.zip
windows7-x64
1JaffaCakes...6d.zip
windows10-2004-x64
108751be484...2d.dll
windows7-x64
1008751be484...2d.dll
windows10-2004-x64
100a9f79abd4...51.exe
windows7-x64
30a9f79abd4...51.exe
windows10-2004-x64
30di3x.exe
windows7-x64
100di3x.exe
windows10-2004-x64
10104.248.22...A.html
windows7-x64
3104.248.22...A.html
windows10-2004-x64
3104.248.22...d.html
windows7-x64
3104.248.22...d.html
windows10-2004-x64
3104.248.22...r.html
windows7-x64
3104.248.22...r.html
windows10-2004-x64
3104.248.22...g.html
windows7-x64
3104.248.22...g.html
windows10-2004-x64
3104.248.22...9.html
windows7-x64
3104.248.22...9.html
windows10-2004-x64
3104.248.22...ain.js
windows7-x64
3104.248.22...ain.js
windows10-2004-x64
311.html
windows7-x64
311.html
windows10-2004-x64
312.html
windows7-x64
912.html
windows10-2004-x64
34a30275f14...ab.dll
windows7-x64
104a30275f14...ab.dll
windows10-2004-x64
102019-09-02...10.exe
windows7-x64
102019-09-02...10.exe
windows10-2004-x64
102c01b00772...eb.exe
windows7-x64
102c01b00772...eb.exe
windows10-2004-x64
731.exe
windows7-x64
1031.exe
windows10-2004-x64
10Analysis
-
max time kernel
90s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24-12-2024 16:52
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_4abc4e174beea2d801bab1f52a202a1adcdc372443e25a2f1875b90f112ff56d.zip
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
JaffaCakes118_4abc4e174beea2d801bab1f52a202a1adcdc372443e25a2f1875b90f112ff56d.zip
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d.dll
Resource
win7-20240729-en
Behavioral task
behavioral4
Sample
08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
0di3x.exe
Resource
win7-20241023-en
Behavioral task
behavioral8
Sample
0di3x.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
104.248.221.3/systemerror-ie-edge/_data_image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAIAAAACACAMA/xhBQAA.html
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
104.248.221.3/systemerror-ie-edge/_data_image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAIAAAACACAMA/xhBQAA.html
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
104.248.221.3/systemerror-ie-edge/dsffddfdfdsawqwq22121sdsd.html
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
104.248.221.3/systemerror-ie-edge/dsffddfdfdsawqwq22121sdsd.html
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
104.248.221.3/systemerror-ie-edge/img/blur.html
Resource
win7-20241010-en
Behavioral task
behavioral14
Sample
104.248.221.3/systemerror-ie-edge/img/blur.html
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
104.248.221.3/systemerror-ie-edge/img/headshot-bg.html
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
104.248.221.3/systemerror-ie-edge/img/headshot-bg.html
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
104.248.221.3/systemerror-ie-edge/indexe2c9.html
Resource
win7-20240708-en
Behavioral task
behavioral18
Sample
104.248.221.3/systemerror-ie-edge/indexe2c9.html
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
104.248.221.3/systemerror-ie-edge/js/main.js
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
104.248.221.3/systemerror-ie-edge/js/main.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
11.html
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
11.html
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
12.html
Resource
win7-20241023-en
Behavioral task
behavioral24
Sample
12.html
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
4a30275f14f80c6e11d5a253d7d004eda98651010e0aa47f744cf4105d1676ab.dll
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
4a30275f14f80c6e11d5a253d7d004eda98651010e0aa47f744cf4105d1676ab.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
2019-09-02_22-41-10.exe
Resource
win7-20241010-en
Behavioral task
behavioral28
Sample
2019-09-02_22-41-10.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
2c01b007729230c415420ad641ad92eb.exe
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
2c01b007729230c415420ad641ad92eb.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
31.exe
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
31.exe
Resource
win10v2004-20241007-en
General
-
Target
2c01b007729230c415420ad641ad92eb.exe
-
Size
1.3MB
-
MD5
daef338f9c47d5394b7e1e60ce38d02d
-
SHA1
c0a07e8c32528d29aae26aaecbf6a67ed95b8c8e
-
SHA256
5d03fd083b626a5516194d5e94576349100c9c98ca7d6845642ed9579980ca58
-
SHA512
d0f4050fc2c5f38ab598729fb6930c84bf779d47b5a8b4e860bc0e9ca8be454ad5dce001d8f88299d8a079eafd4c26efcdd2d196352acfe45e940cc107fcebf4
-
SSDEEP
24576:W85y6Jwdt8jtWoJpXWHALGX+C1Co3aP8jvuC7g6zwm4m53Sb21SR:HXsSGuC/MIvuC5kFm53Sy1SR
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation 2c01b007729230c415420ad641ad92eb.exe -
Executes dropped EXE 4 IoCs
pid Process 740 odm.exe 1388 odm.exe 4952 odm.exe 2968 odm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language odm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language odm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language odm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2c01b007729230c415420ad641ad92eb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language odm.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1388 odm.exe 1388 odm.exe 740 odm.exe 740 odm.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4636 wrote to memory of 740 4636 2c01b007729230c415420ad641ad92eb.exe 82 PID 4636 wrote to memory of 740 4636 2c01b007729230c415420ad641ad92eb.exe 82 PID 4636 wrote to memory of 740 4636 2c01b007729230c415420ad641ad92eb.exe 82 PID 4636 wrote to memory of 1388 4636 2c01b007729230c415420ad641ad92eb.exe 85 PID 4636 wrote to memory of 1388 4636 2c01b007729230c415420ad641ad92eb.exe 85 PID 4636 wrote to memory of 1388 4636 2c01b007729230c415420ad641ad92eb.exe 85 PID 1388 wrote to memory of 4952 1388 odm.exe 101 PID 1388 wrote to memory of 4952 1388 odm.exe 101 PID 1388 wrote to memory of 4952 1388 odm.exe 101 PID 740 wrote to memory of 2968 740 odm.exe 102 PID 740 wrote to memory of 2968 740 odm.exe 102 PID 740 wrote to memory of 2968 740 odm.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c01b007729230c415420ad641ad92eb.exe"C:\Users\Admin\AppData\Local\Temp\2c01b007729230c415420ad641ad92eb.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Roaming\wou\odm.exe"C:\Users\Admin\AppData\Roaming\wou\odm.exe" kja-pex2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Users\Admin\AppData\Roaming\wou\odm.exeC:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\HLMPY3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2968
-
-
-
C:\Users\Admin\AppData\Roaming\wou\odm.exe"C:\Users\Admin\AppData\Roaming\wou\odm.exe" kja-pex2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Users\Admin\AppData\Roaming\wou\odm.exeC:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\HLMPY3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4952
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
183KB
MD52fc79199952da8ef486b513a911b6fd4
SHA1c840b0684f2ebdbbf603fabf4a32e629453c48d0
SHA256a4ff9e68389eceb7e9fe4a6c428d156e9b5536e1dc1f83f05e3c69ce312f465c
SHA5127b4fd2a5fb42fbfd4e4f5b4a19b82aa4761bf40192eef83321a034cd531e8a7309e5c68628e594435ae0869579bc251d8eef168c833dc8dbbf75e68d41ec0f4d
-
Filesize
732KB
MD571d8f6d5dc35517275bc38ebcc815f9f
SHA1cae4e8c730de5a01d30aabeb3e5cb2136090ed8d
SHA256fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b
SHA5124826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59
-
Filesize
1.2MB
MD5a5f2dcee6a2a6047aa8fdde1ae2ce290
SHA17a082661c9a3431cd89ed4d9959178d60b9570f7
SHA2567da78e767ff859970c8dae593b62f1366c2c651500eb280f0077a2245a9a8625
SHA512e001300fc56f9bc8e9d61cb904ea6dec5ca447729015c9ff3dccc021f319fcce57ebaabb196a56f80d249dfbb88b4a0a273858cf14c7b9a93c10c9c8bc243d0a