Analysis
-
max time kernel
147s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
10-04-2024 09:02
Static task
static1
Behavioral task
behavioral1
Sample
eab7049536d2509bc3b948248ef195c9_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
eab7049536d2509bc3b948248ef195c9_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
eab7049536d2509bc3b948248ef195c9_JaffaCakes118.exe
-
Size
488KB
-
MD5
eab7049536d2509bc3b948248ef195c9
-
SHA1
ef7411a0b453a57b4d25cf9920f6d00ce3be2cf0
-
SHA256
b7423f2872345adcdfbd5973e7d12dc270b74300d6ff4d59b1886b23ee418965
-
SHA512
8acb89524da36bcaa3ff5c2f4c45e371b1dd13aca9ac3691335871d2af6120e1bc1b4581fdfd35352f8448fcc9a1edae740541f23b8cf87b7de87d4d240283c8
-
SSDEEP
6144:TmmWFCUb0HmCjWLqQoZySpPg98D5tLYW5cWQY6ZAF4aSuLx5HLYGLKvMgAI045lf:TmmUbCmJL/jGA3I6SzS2xLdWkgAIV
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
eab7049536d2509bc3b948248ef195c9_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation eab7049536d2509bc3b948248ef195c9_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
Processes:
eab7049536d2509bc3b948248ef195c9_JaffaCakes118.exepid process 4540 eab7049536d2509bc3b948248ef195c9_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
eab7049536d2509bc3b948248ef195c9_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PvQVdTyIIGLipwbnnDHKCapiSzDXzESOxLkkMUgJcIfxXxJDVF = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\eab7049536d2509bc3b948248ef195c9_JaffaCakes118.exe" eab7049536d2509bc3b948248ef195c9_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
dw20.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dw20.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
dw20.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dw20.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
dw20.exedescription pid process Token: SeRestorePrivilege 4316 dw20.exe Token: SeBackupPrivilege 4316 dw20.exe Token: SeBackupPrivilege 4316 dw20.exe Token: SeBackupPrivilege 4316 dw20.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
eab7049536d2509bc3b948248ef195c9_JaffaCakes118.exeeab7049536d2509bc3b948248ef195c9_JaffaCakes118.exedescription pid process target process PID 876 wrote to memory of 4540 876 eab7049536d2509bc3b948248ef195c9_JaffaCakes118.exe eab7049536d2509bc3b948248ef195c9_JaffaCakes118.exe PID 876 wrote to memory of 4540 876 eab7049536d2509bc3b948248ef195c9_JaffaCakes118.exe eab7049536d2509bc3b948248ef195c9_JaffaCakes118.exe PID 876 wrote to memory of 4540 876 eab7049536d2509bc3b948248ef195c9_JaffaCakes118.exe eab7049536d2509bc3b948248ef195c9_JaffaCakes118.exe PID 4540 wrote to memory of 4316 4540 eab7049536d2509bc3b948248ef195c9_JaffaCakes118.exe dw20.exe PID 4540 wrote to memory of 4316 4540 eab7049536d2509bc3b948248ef195c9_JaffaCakes118.exe dw20.exe PID 4540 wrote to memory of 4316 4540 eab7049536d2509bc3b948248ef195c9_JaffaCakes118.exe dw20.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\eab7049536d2509bc3b948248ef195c9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\eab7049536d2509bc3b948248ef195c9_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Users\Admin\Documents\eab7049536d2509bc3b948248ef195c9_JaffaCakes118.exe"C:\Users\Admin\Documents\eab7049536d2509bc3b948248ef195c9_JaffaCakes118.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 9403⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:4316
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\eab7049536d2509bc3b948248ef195c9_JaffaCakes118.exe.logFilesize
319B
MD5600936e187ce94453648a9245b2b42a5
SHA13349e5da3f713259244a2cbcb4a9dca777f637ed
SHA2561493eb1dc75a64eb2eb06bc9eb2c864b78fc4a2c674108d5183ac7824013ff2d
SHA512d41203f93ed77430dc570e82dc713f09d21942d75d1f9c3c84135421550ac2fa3845b7e46df70d2c57fe97d3a88e43c672771bb8b6433c44584c4e64646c1964
-
C:\Users\Admin\Documents\aclui.dllFilesize
17KB
MD5e99f74ae594c1b373fa0d34193dce208
SHA13933f949724a6702e0038295287a39c53592b11e
SHA2561dbb3b418bd78abb49d583f2b9cea6b20fe9fece0a59c118ddf104a672e29ebd
SHA512355a2a3955e0f50b0c41a24589b9283892689faa61aea6360a1b762f5f2f58166c579b37dc0b003e716c1dc760f1931b73faf6fa3e2b21f8571dbdf5ee37c030
-
C:\Users\Admin\Documents\eab7049536d2509bc3b948248ef195c9_JaffaCakes118.exeFilesize
488KB
MD5eab7049536d2509bc3b948248ef195c9
SHA1ef7411a0b453a57b4d25cf9920f6d00ce3be2cf0
SHA256b7423f2872345adcdfbd5973e7d12dc270b74300d6ff4d59b1886b23ee418965
SHA5128acb89524da36bcaa3ff5c2f4c45e371b1dd13aca9ac3691335871d2af6120e1bc1b4581fdfd35352f8448fcc9a1edae740541f23b8cf87b7de87d4d240283c8
-
memory/876-0-0x0000000075300000-0x00000000758B1000-memory.dmpFilesize
5.7MB
-
memory/876-1-0x0000000075300000-0x00000000758B1000-memory.dmpFilesize
5.7MB
-
memory/876-2-0x0000000001470000-0x0000000001480000-memory.dmpFilesize
64KB
-
memory/876-17-0x0000000075300000-0x00000000758B1000-memory.dmpFilesize
5.7MB
-
memory/4540-18-0x0000000075300000-0x00000000758B1000-memory.dmpFilesize
5.7MB
-
memory/4540-19-0x0000000001780000-0x0000000001790000-memory.dmpFilesize
64KB
-
memory/4540-22-0x0000000075300000-0x00000000758B1000-memory.dmpFilesize
5.7MB
-
memory/4540-38-0x0000000075300000-0x00000000758B1000-memory.dmpFilesize
5.7MB