Analysis
-
max time kernel
143s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
29-03-2024 09:59
Static task
static1
Behavioral task
behavioral1
Sample
1f104b823c9ac140f99dee39536db4e0_JaffaCakes118.exe
Resource
win7-20231129-en
General
-
Target
1f104b823c9ac140f99dee39536db4e0_JaffaCakes118.exe
-
Size
740KB
-
MD5
1f104b823c9ac140f99dee39536db4e0
-
SHA1
1551da1ade3252b446d7a7d80295697138859c50
-
SHA256
a4d3c825a4ec99bcac7e75cecfb3f837c5b4c752c9ee49a070193fcf5221c9bf
-
SHA512
f124db7fce940fd31ab99d4dfb9adafa1d24da985c976136e96637267146cb310d39b79382e447fff07f142b40dbb2c5c731d180e739ea8e6b0e507e618a8e30
-
SSDEEP
12288:P2ghLvPhXpe3Plf/X+tGrn33gUdCjIXjT6rrqX8lb7LMsHPEibTxzGmlFQJBk:BXhZgPlfrrAU4jprrjH3HJFz9+e
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
1f104b823c9ac140f99dee39536db4e0_JaffaCakes118.exeinfopdf.sfx.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation 1f104b823c9ac140f99dee39536db4e0_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation infopdf.sfx.exe -
Executes dropped EXE 2 IoCs
Processes:
infopdf.sfx.exeinfo pdf.exepid process 2808 infopdf.sfx.exe 1312 info pdf.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
info pdf.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UPNP Host = "C:\\Program Files (x86)\\UPNP Host\\upnphost.exe" info pdf.exe -
Processes:
info pdf.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA info pdf.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs
Processes:
flow ioc 22 6.tcp.ngrok.io 37 6.tcp.ngrok.io 45 6.tcp.ngrok.io 52 6.tcp.ngrok.io 54 6.tcp.ngrok.io 59 6.tcp.ngrok.io 14 6.tcp.ngrok.io -
Drops file in Program Files directory 2 IoCs
Processes:
info pdf.exedescription ioc process File created C:\Program Files (x86)\UPNP Host\upnphost.exe info pdf.exe File opened for modification C:\Program Files (x86)\UPNP Host\upnphost.exe info pdf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1960 schtasks.exe 2512 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
info pdf.exepid process 1312 info pdf.exe 1312 info pdf.exe 1312 info pdf.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
info pdf.exepid process 1312 info pdf.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
info pdf.exedescription pid process Token: SeDebugPrivilege 1312 info pdf.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
1f104b823c9ac140f99dee39536db4e0_JaffaCakes118.execmd.exeinfopdf.sfx.exeinfo pdf.exedescription pid process target process PID 972 wrote to memory of 4632 972 1f104b823c9ac140f99dee39536db4e0_JaffaCakes118.exe cmd.exe PID 972 wrote to memory of 4632 972 1f104b823c9ac140f99dee39536db4e0_JaffaCakes118.exe cmd.exe PID 972 wrote to memory of 4632 972 1f104b823c9ac140f99dee39536db4e0_JaffaCakes118.exe cmd.exe PID 4632 wrote to memory of 2808 4632 cmd.exe infopdf.sfx.exe PID 4632 wrote to memory of 2808 4632 cmd.exe infopdf.sfx.exe PID 4632 wrote to memory of 2808 4632 cmd.exe infopdf.sfx.exe PID 2808 wrote to memory of 1312 2808 infopdf.sfx.exe info pdf.exe PID 2808 wrote to memory of 1312 2808 infopdf.sfx.exe info pdf.exe PID 2808 wrote to memory of 1312 2808 infopdf.sfx.exe info pdf.exe PID 1312 wrote to memory of 1960 1312 info pdf.exe schtasks.exe PID 1312 wrote to memory of 1960 1312 info pdf.exe schtasks.exe PID 1312 wrote to memory of 1960 1312 info pdf.exe schtasks.exe PID 1312 wrote to memory of 2512 1312 info pdf.exe schtasks.exe PID 1312 wrote to memory of 2512 1312 info pdf.exe schtasks.exe PID 1312 wrote to memory of 2512 1312 info pdf.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f104b823c9ac140f99dee39536db4e0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1f104b823c9ac140f99dee39536db4e0_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\inf.bat" "2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\infopdf.sfx.exeinfopdf.sfx.exe -pbara -dC:\Users\Admin\AppData\Roaming3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\info pdf.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\info pdf.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "UPNP Host" /xml "C:\Users\Admin\AppData\Local\Temp\tmp79E3.tmp"5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "UPNP Host Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp7ADE.tmp"5⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\inf.batFilesize
36B
MD5934627ff4a68a982fa6804cb94c3dfa3
SHA1de095d8190f945384e1a801f2c800d40d4fd3612
SHA25638133ed3a3fba9525559006d0338baa897f7889a6149371d1daae30e3ce6dd06
SHA512e5277ca8c0a082207612101450f73a5d60bbf48256faa975645394aa3eda96147a0f4ec6822f0992bd26029eeb58ea1eb29c5805bfcc9715829562e9a024e12d
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\infopdf.sfx.exeFilesize
580KB
MD5e91a7d804e54dc53e026f56e3e45961c
SHA1a045896bbe4797cd80890c17b23cd29bbdc9beab
SHA256350a690a878fc026118975c88170de5aa73f42d2b514ce749f68e95bbbb01858
SHA512c07c8ce06dc322d7c6f7d401f7906dcfdf0e7af7fce99c7c455d6668be97501a45d9a4b4443e2abb361fb7b206b2411eb45f8cd81909e388a2a0bcf68f12ccf0
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\info pdf.exeFilesize
431KB
MD5d43d29275fb37b0f267e09235f8a6796
SHA1816ef7e3993c2c9a88829fa34eda6d3495044b86
SHA256729c2c1508855eee3acee4055dc7ea2f4a17d97b6eb0ca903fd24720dfd7f2b0
SHA51227bafd46aafdce0db91700bc8995e55958693a17f9938f3f94e7c6230a472723faaee6a10d07ad2e50237abd3a7211d4ad171b8492adfbca07dafcee4bdb0c04
-
C:\Users\Admin\AppData\Local\Temp\tmp79E3.tmpFilesize
1KB
MD52d19ad7392f7f5d0c9cfd97dfc77f73a
SHA1e4f9fe47a8ccbedd509e608dfcec29216da1288f
SHA2568cbdcb135a0503b74a0774d5dc660f927f39681491f0dd0ce3762a0005e2e7aa
SHA512672511f97c7ba0e7dfc106c343dcbadfdb838f9987ba876e6b5ac936ef33fe91186b5d5ab0bce3c9c0e0178b59b12711bcf9977c65099df891c25efb547ef1dc
-
C:\Users\Admin\AppData\Local\Temp\tmp7ADE.tmpFilesize
1KB
MD588bf0bc1e20b64333f39f1cf2085a729
SHA16d8eeef3d8f118ded3f2f1dc55ffaa71ee5d7ad8
SHA256393c769644b1c640753a6bab46cd6c8cbaf984d116d6f7dd1a071d5f2afa42f9
SHA51274dfacf7443b7b08da09d40bca1b2a99e7dc44d9d5289f86e1b718f3268b1b11e85c04eb8dd0a5e95788726f09678051a27902d509f015a5ff6609c7d8ec9aba
-
memory/1312-19-0x0000000072970000-0x0000000072F21000-memory.dmpFilesize
5.7MB
-
memory/1312-21-0x0000000001300000-0x0000000001310000-memory.dmpFilesize
64KB
-
memory/1312-20-0x0000000072970000-0x0000000072F21000-memory.dmpFilesize
5.7MB
-
memory/1312-29-0x0000000001300000-0x0000000001310000-memory.dmpFilesize
64KB
-
memory/1312-30-0x0000000072970000-0x0000000072F21000-memory.dmpFilesize
5.7MB
-
memory/1312-31-0x0000000072970000-0x0000000072F21000-memory.dmpFilesize
5.7MB
-
memory/1312-32-0x0000000001300000-0x0000000001310000-memory.dmpFilesize
64KB
-
memory/1312-33-0x0000000001300000-0x0000000001310000-memory.dmpFilesize
64KB