Analysis
-
max time kernel
93s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
11-04-2024 19:11
Static task
static1
Behavioral task
behavioral1
Sample
ee243a5d55da1ae9747db59ca1d32f2b_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ee243a5d55da1ae9747db59ca1d32f2b_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
ee243a5d55da1ae9747db59ca1d32f2b_JaffaCakes118.exe
-
Size
6.5MB
-
MD5
ee243a5d55da1ae9747db59ca1d32f2b
-
SHA1
f5b590379f316e40b61151c12490ddc83aa17dc5
-
SHA256
a70325fd7314f54c43623316fcf8e7cb993570d8cab123a9e16ef7f5d5260309
-
SHA512
4510176dd723ae3f95b21d6a1afe25639e9fa06d0e3e29f5093b7e26a395dbdf7ae6490ff08a6e1fdc21b269d9a961c9f52fd36ce276d15364b20cf77b956cb2
-
SSDEEP
98304:/94Bxd7pLwwhfAqVo9Eo7bfkNxU+1Nhga4a/ZSm:/gdOwlhNqa4a/ZSm
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
ee243a5d55da1ae9747db59ca1d32f2b_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation ee243a5d55da1ae9747db59ca1d32f2b_JaffaCakes118.exe -
Drops startup file 2 IoCs
Processes:
ee243a5d55da1ae9747db59ca1d32f2b_JaffaCakes118.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jgffghjhgffghjgfd.exe ee243a5d55da1ae9747db59ca1d32f2b_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jgffghjhgffghjgfd.exe ee243a5d55da1ae9747db59ca1d32f2b_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
Processes:
jgffghjhgffghjgfd.exepid process 3944 jgffghjhgffghjgfd.exe -
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral2/memory/1160-7-0x0000000006E60000-0x0000000006E88000-memory.dmp agile_net -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ggfjgfguytdffdf = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\jgffghjhgffghjgfd.exe" reg.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
ee243a5d55da1ae9747db59ca1d32f2b_JaffaCakes118.exejgffghjhgffghjgfd.exepid process 1160 ee243a5d55da1ae9747db59ca1d32f2b_JaffaCakes118.exe 1160 ee243a5d55da1ae9747db59ca1d32f2b_JaffaCakes118.exe 1160 ee243a5d55da1ae9747db59ca1d32f2b_JaffaCakes118.exe 1160 ee243a5d55da1ae9747db59ca1d32f2b_JaffaCakes118.exe 1160 ee243a5d55da1ae9747db59ca1d32f2b_JaffaCakes118.exe 1160 ee243a5d55da1ae9747db59ca1d32f2b_JaffaCakes118.exe 1160 ee243a5d55da1ae9747db59ca1d32f2b_JaffaCakes118.exe 1160 ee243a5d55da1ae9747db59ca1d32f2b_JaffaCakes118.exe 1160 ee243a5d55da1ae9747db59ca1d32f2b_JaffaCakes118.exe 1160 ee243a5d55da1ae9747db59ca1d32f2b_JaffaCakes118.exe 1160 ee243a5d55da1ae9747db59ca1d32f2b_JaffaCakes118.exe 1160 ee243a5d55da1ae9747db59ca1d32f2b_JaffaCakes118.exe 1160 ee243a5d55da1ae9747db59ca1d32f2b_JaffaCakes118.exe 1160 ee243a5d55da1ae9747db59ca1d32f2b_JaffaCakes118.exe 1160 ee243a5d55da1ae9747db59ca1d32f2b_JaffaCakes118.exe 1160 ee243a5d55da1ae9747db59ca1d32f2b_JaffaCakes118.exe 1160 ee243a5d55da1ae9747db59ca1d32f2b_JaffaCakes118.exe 1160 ee243a5d55da1ae9747db59ca1d32f2b_JaffaCakes118.exe 1160 ee243a5d55da1ae9747db59ca1d32f2b_JaffaCakes118.exe 1160 ee243a5d55da1ae9747db59ca1d32f2b_JaffaCakes118.exe 1160 ee243a5d55da1ae9747db59ca1d32f2b_JaffaCakes118.exe 1160 ee243a5d55da1ae9747db59ca1d32f2b_JaffaCakes118.exe 1160 ee243a5d55da1ae9747db59ca1d32f2b_JaffaCakes118.exe 3944 jgffghjhgffghjgfd.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
ee243a5d55da1ae9747db59ca1d32f2b_JaffaCakes118.exejgffghjhgffghjgfd.exedescription pid process Token: SeDebugPrivilege 1160 ee243a5d55da1ae9747db59ca1d32f2b_JaffaCakes118.exe Token: SeDebugPrivilege 3944 jgffghjhgffghjgfd.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
ee243a5d55da1ae9747db59ca1d32f2b_JaffaCakes118.execmd.exedescription pid process target process PID 1160 wrote to memory of 5056 1160 ee243a5d55da1ae9747db59ca1d32f2b_JaffaCakes118.exe cmd.exe PID 1160 wrote to memory of 5056 1160 ee243a5d55da1ae9747db59ca1d32f2b_JaffaCakes118.exe cmd.exe PID 1160 wrote to memory of 5056 1160 ee243a5d55da1ae9747db59ca1d32f2b_JaffaCakes118.exe cmd.exe PID 5056 wrote to memory of 3004 5056 cmd.exe reg.exe PID 5056 wrote to memory of 3004 5056 cmd.exe reg.exe PID 5056 wrote to memory of 3004 5056 cmd.exe reg.exe PID 1160 wrote to memory of 3944 1160 ee243a5d55da1ae9747db59ca1d32f2b_JaffaCakes118.exe jgffghjhgffghjgfd.exe PID 1160 wrote to memory of 3944 1160 ee243a5d55da1ae9747db59ca1d32f2b_JaffaCakes118.exe jgffghjhgffghjgfd.exe PID 1160 wrote to memory of 3944 1160 ee243a5d55da1ae9747db59ca1d32f2b_JaffaCakes118.exe jgffghjhgffghjgfd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee243a5d55da1ae9747db59ca1d32f2b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ee243a5d55da1ae9747db59ca1d32f2b_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ggfjgfguytdffdf" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jgffghjhgffghjgfd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ggfjgfguytdffdf" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jgffghjhgffghjgfd.exe"3⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jgffghjhgffghjgfd.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jgffghjhgffghjgfd.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jgffghjhgffghjgfd.exeFilesize
6.5MB
MD5ee243a5d55da1ae9747db59ca1d32f2b
SHA1f5b590379f316e40b61151c12490ddc83aa17dc5
SHA256a70325fd7314f54c43623316fcf8e7cb993570d8cab123a9e16ef7f5d5260309
SHA5124510176dd723ae3f95b21d6a1afe25639e9fa06d0e3e29f5093b7e26a395dbdf7ae6490ff08a6e1fdc21b269d9a961c9f52fd36ce276d15364b20cf77b956cb2
-
memory/1160-8-0x0000000006F10000-0x0000000006F76000-memory.dmpFilesize
408KB
-
memory/1160-3-0x0000000005330000-0x00000000053C2000-memory.dmpFilesize
584KB
-
memory/1160-10-0x0000000005300000-0x0000000005310000-memory.dmpFilesize
64KB
-
memory/1160-11-0x0000000074E20000-0x00000000755D0000-memory.dmpFilesize
7.7MB
-
memory/1160-5-0x0000000005DF0000-0x0000000005E8C000-memory.dmpFilesize
624KB
-
memory/1160-6-0x0000000005300000-0x0000000005310000-memory.dmpFilesize
64KB
-
memory/1160-7-0x0000000006E60000-0x0000000006E88000-memory.dmpFilesize
160KB
-
memory/1160-0-0x0000000074E20000-0x00000000755D0000-memory.dmpFilesize
7.7MB
-
memory/1160-9-0x0000000006EE0000-0x0000000006F02000-memory.dmpFilesize
136KB
-
memory/1160-2-0x0000000005840000-0x0000000005DE4000-memory.dmpFilesize
5.6MB
-
memory/1160-4-0x00000000053D0000-0x0000000005724000-memory.dmpFilesize
3.3MB
-
memory/1160-12-0x0000000005300000-0x0000000005310000-memory.dmpFilesize
64KB
-
memory/1160-13-0x0000000005300000-0x0000000005310000-memory.dmpFilesize
64KB
-
memory/1160-1-0x00000000002D0000-0x000000000094A000-memory.dmpFilesize
6.5MB
-
memory/1160-27-0x0000000074E20000-0x00000000755D0000-memory.dmpFilesize
7.7MB
-
memory/3944-28-0x0000000074E20000-0x00000000755D0000-memory.dmpFilesize
7.7MB
-
memory/3944-29-0x0000000005A60000-0x0000000005A70000-memory.dmpFilesize
64KB
-
memory/3944-31-0x0000000074E20000-0x00000000755D0000-memory.dmpFilesize
7.7MB