Analysis
-
max time kernel
121s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
02-04-2024 22:01
Static task
static1
Behavioral task
behavioral1
Sample
984ed804482b455638e29cfa56d91e86_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
984ed804482b455638e29cfa56d91e86_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
984ed804482b455638e29cfa56d91e86_JaffaCakes118.exe
-
Size
62KB
-
MD5
984ed804482b455638e29cfa56d91e86
-
SHA1
608e262d942f5d464a68b9ffee0c83f99b99c901
-
SHA256
fd8b588e1ee4f98e4498e9a39c29ca2fcb974b55680139a12cccb49657da7658
-
SHA512
999915dea839739bf03814154ae2b96e4f433166af37d4e7a234ecbce2669ee0fae11bf82b2169820d436e9d2d8b3f2a5041f84068f85b9516f3031671841690
-
SSDEEP
768:CKsMqCXfVcWJDrM9ZkiANIUAHYLDwUzc80gmq3oP/oDM:CKsexM9ZkiAPTr/0O8/ow
Malware Config
Signatures
-
Nitro
A ransomware that demands Discord nitro gift codes to decrypt files.
-
Renames multiple (88) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\NR = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\984ed804482b455638e29cfa56d91e86_JaffaCakes118.exe\"" 984ed804482b455638e29cfa56d91e86_JaffaCakes118.exe -
Drops desktop.ini file(s) 3 IoCs
description ioc Process File opened for modification C:\Users\Admin\Documents\desktop.ini 984ed804482b455638e29cfa56d91e86_JaffaCakes118.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 984ed804482b455638e29cfa56d91e86_JaffaCakes118.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 984ed804482b455638e29cfa56d91e86_JaffaCakes118.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
flow ioc 7 discord.com 8 discord.com 9 discord.com 10 discord.com 11 discord.com 6 discord.com -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 api.ipify.org 5 api.ipify.org -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\wallpaper.png" 984ed804482b455638e29cfa56d91e86_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Pictures\\My Wallpaper.jpg" 984ed804482b455638e29cfa56d91e86_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2912 984ed804482b455638e29cfa56d91e86_JaffaCakes118.exe 2912 984ed804482b455638e29cfa56d91e86_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeDebugPrivilege 2912 984ed804482b455638e29cfa56d91e86_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 2724 WMIC.exe Token: SeSecurityPrivilege 2724 WMIC.exe Token: SeTakeOwnershipPrivilege 2724 WMIC.exe Token: SeLoadDriverPrivilege 2724 WMIC.exe Token: SeSystemProfilePrivilege 2724 WMIC.exe Token: SeSystemtimePrivilege 2724 WMIC.exe Token: SeProfSingleProcessPrivilege 2724 WMIC.exe Token: SeIncBasePriorityPrivilege 2724 WMIC.exe Token: SeCreatePagefilePrivilege 2724 WMIC.exe Token: SeBackupPrivilege 2724 WMIC.exe Token: SeRestorePrivilege 2724 WMIC.exe Token: SeShutdownPrivilege 2724 WMIC.exe Token: SeDebugPrivilege 2724 WMIC.exe Token: SeSystemEnvironmentPrivilege 2724 WMIC.exe Token: SeRemoteShutdownPrivilege 2724 WMIC.exe Token: SeUndockPrivilege 2724 WMIC.exe Token: SeManageVolumePrivilege 2724 WMIC.exe Token: 33 2724 WMIC.exe Token: 34 2724 WMIC.exe Token: 35 2724 WMIC.exe Token: SeIncreaseQuotaPrivilege 2724 WMIC.exe Token: SeSecurityPrivilege 2724 WMIC.exe Token: SeTakeOwnershipPrivilege 2724 WMIC.exe Token: SeLoadDriverPrivilege 2724 WMIC.exe Token: SeSystemProfilePrivilege 2724 WMIC.exe Token: SeSystemtimePrivilege 2724 WMIC.exe Token: SeProfSingleProcessPrivilege 2724 WMIC.exe Token: SeIncBasePriorityPrivilege 2724 WMIC.exe Token: SeCreatePagefilePrivilege 2724 WMIC.exe Token: SeBackupPrivilege 2724 WMIC.exe Token: SeRestorePrivilege 2724 WMIC.exe Token: SeShutdownPrivilege 2724 WMIC.exe Token: SeDebugPrivilege 2724 WMIC.exe Token: SeSystemEnvironmentPrivilege 2724 WMIC.exe Token: SeRemoteShutdownPrivilege 2724 WMIC.exe Token: SeUndockPrivilege 2724 WMIC.exe Token: SeManageVolumePrivilege 2724 WMIC.exe Token: 33 2724 WMIC.exe Token: 34 2724 WMIC.exe Token: 35 2724 WMIC.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2912 wrote to memory of 2548 2912 984ed804482b455638e29cfa56d91e86_JaffaCakes118.exe 28 PID 2912 wrote to memory of 2548 2912 984ed804482b455638e29cfa56d91e86_JaffaCakes118.exe 28 PID 2912 wrote to memory of 2548 2912 984ed804482b455638e29cfa56d91e86_JaffaCakes118.exe 28 PID 2912 wrote to memory of 2548 2912 984ed804482b455638e29cfa56d91e86_JaffaCakes118.exe 28 PID 2548 wrote to memory of 2724 2548 cmd.exe 30 PID 2548 wrote to memory of 2724 2548 cmd.exe 30 PID 2548 wrote to memory of 2724 2548 cmd.exe 30 PID 2548 wrote to memory of 2724 2548 cmd.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\984ed804482b455638e29cfa56d91e86_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\984ed804482b455638e29cfa56d91e86_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic csproduct get uuid3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2724
-
-