Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2024 08:41
Static task
static1
Behavioral task
behavioral1
Sample
01863136c202a0df665d3c05549f6f0f_JaffaCakes118.exe
Resource
win7-20231129-en
General
-
Target
01863136c202a0df665d3c05549f6f0f_JaffaCakes118.exe
-
Size
570KB
-
MD5
01863136c202a0df665d3c05549f6f0f
-
SHA1
3c7491155a98d6a50e54f0ded6b6acf95e7e0eb8
-
SHA256
b75d52e883034848f4e22ae6a13d42cb6bc85dce0dd524572c9d9ba1a81f9ca1
-
SHA512
6c24a8676b5fd3d369a71660e7787c490e017378bfc6a0d3548c76d9910b7302c72df0628e513d1f75ceee0559b3b28824d5ee748e506099d25b7f120e972476
-
SSDEEP
6144:hmpz5hiNU5PRLGGTxcwQbyc8DdgiJdBL2nFeIOl8V6IghYNmnTV+WEZ4Z+YirYP2:hzaPtGkQbaDdbDBL2JW8II9WEifsSJo
Malware Config
Extracted
formbook
4.1
gd3e
losfesdffewfdskokoka11.xyz
aspenroofingel.net
mlstrategygroup.com
breakaway.asia
gzmx3.com
dronesadvise.com
bitmain.discount
lifestylekenya.com
dragonfly-road.store
rumbaughrecruiting.com
tarimech.com
starmcb.com
xn--kfz-schlsseldienst-t6b.com
eqgiftshop.com
regionsi.com
bonsainer.com
guideofguardians.com
orlv7x.icu
xemnha100.com
thelupinlady.com
irideomacula.xyz
xanudu.com
fudgeho.com
mrkambu.com
lovedhouseishome.com
qualesusings.xyz
habbinz.online
video-registrator.site
abccookiebiz.com
betterpeixun.com
hotosita.website
metamars.life
journalofmj.com
magnoliagarnish.com
ziyouff.com
moneyshotvid.com
lariontsev.com
hulattsfurniture.com
vidoil.net
rostovetagi.store
trafalgarlonepiece.com
xyperfumecollection.com
northfaceuksaleoutlet.com
rupiahtoto.tech
primordialroot.com
emsteapot.com
dentistryforhealthnj.com
sanaoll.com
zmapo.xyz
mobilenotaryservicesfl.com
evolvevigor.com
2sscu.icu
tafefg.online
squid-mask.net
bluetulipboutique.com
chelsearenee.coach
pepsigoandplay.com
narrativenips.com
seowhiteflag.com
toiletseatsgalore.com
tongchibo.com
antiquestores.xyz
richardfecteau2021.com
cosmosglobaltrade.xyz
lasakaya.com
Signatures
-
Formbook payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4524-16-0x0000000000400000-0x000000000042F000-memory.dmp formbook -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
01863136c202a0df665d3c05549f6f0f_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation 01863136c202a0df665d3c05549f6f0f_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
01863136c202a0df665d3c05549f6f0f_JaffaCakes118.exedescription pid process target process PID 3596 set thread context of 4524 3596 01863136c202a0df665d3c05549f6f0f_JaffaCakes118.exe 01863136c202a0df665d3c05549f6f0f_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
01863136c202a0df665d3c05549f6f0f_JaffaCakes118.exepid process 4524 01863136c202a0df665d3c05549f6f0f_JaffaCakes118.exe 4524 01863136c202a0df665d3c05549f6f0f_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
01863136c202a0df665d3c05549f6f0f_JaffaCakes118.exedescription pid process target process PID 3596 wrote to memory of 1696 3596 01863136c202a0df665d3c05549f6f0f_JaffaCakes118.exe schtasks.exe PID 3596 wrote to memory of 1696 3596 01863136c202a0df665d3c05549f6f0f_JaffaCakes118.exe schtasks.exe PID 3596 wrote to memory of 1696 3596 01863136c202a0df665d3c05549f6f0f_JaffaCakes118.exe schtasks.exe PID 3596 wrote to memory of 4524 3596 01863136c202a0df665d3c05549f6f0f_JaffaCakes118.exe 01863136c202a0df665d3c05549f6f0f_JaffaCakes118.exe PID 3596 wrote to memory of 4524 3596 01863136c202a0df665d3c05549f6f0f_JaffaCakes118.exe 01863136c202a0df665d3c05549f6f0f_JaffaCakes118.exe PID 3596 wrote to memory of 4524 3596 01863136c202a0df665d3c05549f6f0f_JaffaCakes118.exe 01863136c202a0df665d3c05549f6f0f_JaffaCakes118.exe PID 3596 wrote to memory of 4524 3596 01863136c202a0df665d3c05549f6f0f_JaffaCakes118.exe 01863136c202a0df665d3c05549f6f0f_JaffaCakes118.exe PID 3596 wrote to memory of 4524 3596 01863136c202a0df665d3c05549f6f0f_JaffaCakes118.exe 01863136c202a0df665d3c05549f6f0f_JaffaCakes118.exe PID 3596 wrote to memory of 4524 3596 01863136c202a0df665d3c05549f6f0f_JaffaCakes118.exe 01863136c202a0df665d3c05549f6f0f_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\01863136c202a0df665d3c05549f6f0f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\01863136c202a0df665d3c05549f6f0f_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sPsWoUxI" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB48B.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\01863136c202a0df665d3c05549f6f0f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\01863136c202a0df665d3c05549f6f0f_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3596-6-0x0000000002EC0000-0x0000000002ECE000-memory.dmpFilesize
56KB
-
memory/3596-8-0x0000000007C50000-0x0000000007C60000-memory.dmpFilesize
64KB
-
memory/3596-2-0x0000000007FB0000-0x0000000008554000-memory.dmpFilesize
5.6MB
-
memory/3596-3-0x0000000007AE0000-0x0000000007B72000-memory.dmpFilesize
584KB
-
memory/3596-4-0x0000000007C50000-0x0000000007C60000-memory.dmpFilesize
64KB
-
memory/3596-5-0x0000000007B90000-0x0000000007B9A000-memory.dmpFilesize
40KB
-
memory/3596-0-0x0000000000BC0000-0x0000000000C54000-memory.dmpFilesize
592KB
-
memory/3596-7-0x00000000752B0000-0x0000000075A60000-memory.dmpFilesize
7.7MB
-
memory/3596-1-0x00000000752B0000-0x0000000075A60000-memory.dmpFilesize
7.7MB
-
memory/3596-9-0x00000000091C0000-0x000000000925C000-memory.dmpFilesize
624KB
-
memory/3596-10-0x000000000CBE0000-0x000000000CC38000-memory.dmpFilesize
352KB
-
memory/3596-18-0x00000000752B0000-0x0000000075A60000-memory.dmpFilesize
7.7MB
-
memory/4524-16-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4524-19-0x00000000019C0000-0x0000000001D0A000-memory.dmpFilesize
3.3MB
-
memory/4524-20-0x00000000019C0000-0x0000000001D0A000-memory.dmpFilesize
3.3MB