Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
18-04-2024 00:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f6deaf165da7a337c68048a046178c57_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
13 signatures
150 seconds
General
-
Target
f6deaf165da7a337c68048a046178c57_JaffaCakes118.exe
-
Size
318KB
-
MD5
f6deaf165da7a337c68048a046178c57
-
SHA1
ff6ce2d1eb1d81a392e0b6acf02017fbbf526181
-
SHA256
d19c4864f78997a15056dd3dd3e53e144c412d1add11866ed2b36c6e933797a5
-
SHA512
ba8f18fc2806e3325e09dd7aef269da6eacf6ce6a884b87b4e354b311106a0f24bbc147ba987087bdfa861d395b9412c5464efbd7a570d51a4d0d75a83dc5562
-
SSDEEP
6144:gTu5OUFQPwNcv0kPmAGsyRILcAHRsNW+oKE0QJDBx0KEVaLOrd8ZH22aY:iuzmOCzGyiNW+oz06Bx0fByH2BY
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
f6deaf165da7a337c68048a046178c57_JaffaCakes118.exeexplorer.exenvxdsinc.exedescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation f6deaf165da7a337c68048a046178c57_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation explorer.exe Key value queried \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation nvxdsinc.exe -
Deletes itself 1 IoCs
Processes:
explorer.exepid Process 5376 explorer.exe -
Executes dropped EXE 3 IoCs
Processes:
explorer.exenvxdsinc.exenwtray.exepid Process 5376 explorer.exe 3452 nvxdsinc.exe 5412 nwtray.exe -
Processes:
resource yara_rule behavioral2/memory/5192-22-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/5192-23-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/5192-24-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/5192-27-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/5192-33-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/5192-38-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/5192-39-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/5192-41-0x0000000000400000-0x00000000004B5000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
nvxdsinc.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\System\\nvxdsinc.exe" nvxdsinc.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
explorer.exenwtray.exedescription pid Process procid_target PID 5376 set thread context of 5192 5376 explorer.exe 91 PID 5412 set thread context of 4208 5412 nwtray.exe 94 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
explorer.exenvxdsinc.exenwtray.exepid Process 5376 explorer.exe 3452 nvxdsinc.exe 5412 nwtray.exe 5376 explorer.exe 3452 nvxdsinc.exe 5412 nwtray.exe 5376 explorer.exe 3452 nvxdsinc.exe 5412 nwtray.exe 5376 explorer.exe 3452 nvxdsinc.exe 5412 nwtray.exe 5376 explorer.exe 3452 nvxdsinc.exe 5412 nwtray.exe 5376 explorer.exe 3452 nvxdsinc.exe 5412 nwtray.exe 5376 explorer.exe 3452 nvxdsinc.exe 5412 nwtray.exe 5376 explorer.exe 3452 nvxdsinc.exe 5412 nwtray.exe 5376 explorer.exe 3452 nvxdsinc.exe 5412 nwtray.exe 5376 explorer.exe 3452 nvxdsinc.exe 5412 nwtray.exe 5376 explorer.exe 3452 nvxdsinc.exe 5412 nwtray.exe 5376 explorer.exe 3452 nvxdsinc.exe 5412 nwtray.exe 5376 explorer.exe 3452 nvxdsinc.exe 5412 nwtray.exe 5376 explorer.exe 3452 nvxdsinc.exe 5412 nwtray.exe 5376 explorer.exe 3452 nvxdsinc.exe 5412 nwtray.exe 5376 explorer.exe 3452 nvxdsinc.exe 5412 nwtray.exe 5376 explorer.exe 3452 nvxdsinc.exe 5412 nwtray.exe 5376 explorer.exe 3452 nvxdsinc.exe 5412 nwtray.exe 5376 explorer.exe 3452 nvxdsinc.exe 5412 nwtray.exe 5376 explorer.exe 3452 nvxdsinc.exe 5412 nwtray.exe 5376 explorer.exe 3452 nvxdsinc.exe 5412 nwtray.exe 5376 explorer.exe -
Suspicious use of AdjustPrivilegeToken 52 IoCs
Processes:
f6deaf165da7a337c68048a046178c57_JaffaCakes118.exeexplorer.exeAppLaunch.exenvxdsinc.exenwtray.exeAppLaunch.exedescription pid Process Token: SeDebugPrivilege 2584 f6deaf165da7a337c68048a046178c57_JaffaCakes118.exe Token: SeDebugPrivilege 5376 explorer.exe Token: SeIncreaseQuotaPrivilege 5192 AppLaunch.exe Token: SeSecurityPrivilege 5192 AppLaunch.exe Token: SeTakeOwnershipPrivilege 5192 AppLaunch.exe Token: SeLoadDriverPrivilege 5192 AppLaunch.exe Token: SeSystemProfilePrivilege 5192 AppLaunch.exe Token: SeSystemtimePrivilege 5192 AppLaunch.exe Token: SeProfSingleProcessPrivilege 5192 AppLaunch.exe Token: SeIncBasePriorityPrivilege 5192 AppLaunch.exe Token: SeCreatePagefilePrivilege 5192 AppLaunch.exe Token: SeBackupPrivilege 5192 AppLaunch.exe Token: SeRestorePrivilege 5192 AppLaunch.exe Token: SeShutdownPrivilege 5192 AppLaunch.exe Token: SeDebugPrivilege 5192 AppLaunch.exe Token: SeSystemEnvironmentPrivilege 5192 AppLaunch.exe Token: SeChangeNotifyPrivilege 5192 AppLaunch.exe Token: SeRemoteShutdownPrivilege 5192 AppLaunch.exe Token: SeUndockPrivilege 5192 AppLaunch.exe Token: SeManageVolumePrivilege 5192 AppLaunch.exe Token: SeImpersonatePrivilege 5192 AppLaunch.exe Token: SeCreateGlobalPrivilege 5192 AppLaunch.exe Token: 33 5192 AppLaunch.exe Token: 34 5192 AppLaunch.exe Token: 35 5192 AppLaunch.exe Token: 36 5192 AppLaunch.exe Token: SeDebugPrivilege 3452 nvxdsinc.exe Token: SeDebugPrivilege 5412 nwtray.exe Token: SeIncreaseQuotaPrivilege 4208 AppLaunch.exe Token: SeSecurityPrivilege 4208 AppLaunch.exe Token: SeTakeOwnershipPrivilege 4208 AppLaunch.exe Token: SeLoadDriverPrivilege 4208 AppLaunch.exe Token: SeSystemProfilePrivilege 4208 AppLaunch.exe Token: SeSystemtimePrivilege 4208 AppLaunch.exe Token: SeProfSingleProcessPrivilege 4208 AppLaunch.exe Token: SeIncBasePriorityPrivilege 4208 AppLaunch.exe Token: SeCreatePagefilePrivilege 4208 AppLaunch.exe Token: SeBackupPrivilege 4208 AppLaunch.exe Token: SeRestorePrivilege 4208 AppLaunch.exe Token: SeShutdownPrivilege 4208 AppLaunch.exe Token: SeDebugPrivilege 4208 AppLaunch.exe Token: SeSystemEnvironmentPrivilege 4208 AppLaunch.exe Token: SeChangeNotifyPrivilege 4208 AppLaunch.exe Token: SeRemoteShutdownPrivilege 4208 AppLaunch.exe Token: SeUndockPrivilege 4208 AppLaunch.exe Token: SeManageVolumePrivilege 4208 AppLaunch.exe Token: SeImpersonatePrivilege 4208 AppLaunch.exe Token: SeCreateGlobalPrivilege 4208 AppLaunch.exe Token: 33 4208 AppLaunch.exe Token: 34 4208 AppLaunch.exe Token: 35 4208 AppLaunch.exe Token: 36 4208 AppLaunch.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
AppLaunch.exepid Process 5192 AppLaunch.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
f6deaf165da7a337c68048a046178c57_JaffaCakes118.exeexplorer.exenvxdsinc.exenwtray.exedescription pid Process procid_target PID 2584 wrote to memory of 5376 2584 f6deaf165da7a337c68048a046178c57_JaffaCakes118.exe 88 PID 2584 wrote to memory of 5376 2584 f6deaf165da7a337c68048a046178c57_JaffaCakes118.exe 88 PID 2584 wrote to memory of 5376 2584 f6deaf165da7a337c68048a046178c57_JaffaCakes118.exe 88 PID 5376 wrote to memory of 5192 5376 explorer.exe 91 PID 5376 wrote to memory of 5192 5376 explorer.exe 91 PID 5376 wrote to memory of 5192 5376 explorer.exe 91 PID 5376 wrote to memory of 5192 5376 explorer.exe 91 PID 5376 wrote to memory of 5192 5376 explorer.exe 91 PID 5376 wrote to memory of 5192 5376 explorer.exe 91 PID 5376 wrote to memory of 5192 5376 explorer.exe 91 PID 5376 wrote to memory of 5192 5376 explorer.exe 91 PID 5376 wrote to memory of 3452 5376 explorer.exe 92 PID 5376 wrote to memory of 3452 5376 explorer.exe 92 PID 5376 wrote to memory of 3452 5376 explorer.exe 92 PID 3452 wrote to memory of 5412 3452 nvxdsinc.exe 93 PID 3452 wrote to memory of 5412 3452 nvxdsinc.exe 93 PID 3452 wrote to memory of 5412 3452 nvxdsinc.exe 93 PID 5412 wrote to memory of 4208 5412 nwtray.exe 94 PID 5412 wrote to memory of 4208 5412 nwtray.exe 94 PID 5412 wrote to memory of 4208 5412 nwtray.exe 94 PID 5412 wrote to memory of 4208 5412 nwtray.exe 94 PID 5412 wrote to memory of 4208 5412 nwtray.exe 94 PID 5412 wrote to memory of 4208 5412 nwtray.exe 94 PID 5412 wrote to memory of 4208 5412 nwtray.exe 94 PID 5412 wrote to memory of 4208 5412 nwtray.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\f6deaf165da7a337c68048a046178c57_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f6deaf165da7a337c68048a046178c57_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5376 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5192
-
-
C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe"C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe"C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5412 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe5⤵
- Suspicious use of AdjustPrivilegeToken
PID:4208
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
84B
MD58922901d63b9e2258191ccb4a17c6652
SHA1220ea54ec503be0dc8e98816f3f50f84eabec6f4
SHA2560c4eba0fba9195a885727f305e6be04f4906ddfc979f82b31e55afebbfa3fa3a
SHA512660a51f4df1ed354424538224cc5756a12eb752124fcc271283a417870db56261da82c66b77732da9ce30a2dc452fd407f0292447432b5b68118519bb07d55f6
-
Filesize
39KB
MD538abcaec6ee62213f90b1717d830a1bb
SHA1d8f5849d0d3f4ccc0dfb66a9a4a0442ac66a31b9
SHA2566fee9a2c70b2cc48b0812f7cb2e09497c9c90941976f430a8f8279ad3c787768
SHA51277eaabcbc6f7a3835b6220d72c4b1cae82d2125ea971907e33b15ceeede7e4da0741c6e63e988bd782ed6eb72ad3cbcba10ea83919eafd9b95d612c43a735274
-
Filesize
318KB
MD5f6deaf165da7a337c68048a046178c57
SHA1ff6ce2d1eb1d81a392e0b6acf02017fbbf526181
SHA256d19c4864f78997a15056dd3dd3e53e144c412d1add11866ed2b36c6e933797a5
SHA512ba8f18fc2806e3325e09dd7aef269da6eacf6ce6a884b87b4e354b311106a0f24bbc147ba987087bdfa861d395b9412c5464efbd7a570d51a4d0d75a83dc5562