Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
18-04-2024 11:14
Static task
static1
Behavioral task
behavioral1
Sample
f7e16970e5f6aec9ed1fb634bfee3269_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
f7e16970e5f6aec9ed1fb634bfee3269_JaffaCakes118.exe
-
Size
483KB
-
MD5
f7e16970e5f6aec9ed1fb634bfee3269
-
SHA1
f939bfe961ac41b7a35f7763398d18248ffdf965
-
SHA256
1f7b393e44ad6fcc5273bd57a21db95f4f20ca715cab20157455edd05f87f672
-
SHA512
270f06a3ae1e17fe7db5e40c98b14d1f0be29f94921c6c357fc26be93d577d4e8564320ef010eceabfe4a9790fa9a2bcc0a5bebaf51e30b0cdd314a096e0779d
-
SSDEEP
6144:5IFhuSYWFYgrKsUc3y2WnO1xzcWmZXe2rkwnbo60T21BOcCSrYDEgfje5ig1ef9B:0h8Mz+sv3y2N1xzAZprkmuN/SD5iKefz
Malware Config
Extracted
formbook
3.9
ow
piavecaffe.com
jlxkqg.men
lifesavingfoundation.net
karadasama.net
michaeltraolach-macsweeney.com
thunderwatches.com
serviciocasawhirlpool.biz
c-cap.online
itparksolution.com
clarityhearingkw.com
wpgrosiri.date
colemarshalcambell.com
webperffest.com
adjusterforirma.info
buildersqq.com
spiritualwisdominindia.com
111222333.net
traditionalarabicdishes.com
hmlifi.com
receive-our-info-heredaily.info
whitecoins.info
woodiesrattlers.com
www8458l.com
fifanie.com
xn--qrq721bqkkzt3b.net
mesquiteleaffarm.com
xn--30-yo3c105l5jn.com
imaginaryfair.com
dawnanddusted.com
youeronline.com
alyssabrandonportfolio.com
winhealthalert.info
fithappenseveryday.com
3dreplicant.net
exiaomaipu.com
billsmockupdomain.com
radicalmiddleusa.com
fatblastingsupplements.com
okvidaoapp.com
1024eees.info
gdbaisu.com
soluciones-libres.com
guansaidingzhi.com
francesca-lynagh.com
airbodycare.com
atlutes.com
learningtolaughintherain.com
zology-tek.com
bjlmzk.com
watchinglass.com
belltowerhealthcare.com
gaetvr.men
xn--j7q21wggj81l.net
photos4lyfe.net
paisaghat.com
repairextend.win
lifesciencescareers.com
bazar-199.com
timepieceluxury.com
wizeater.com
itdui.com
johnshookgp.com
lesderniers.com
goodsystemforupdates.review
cybep.com
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/4340-19-0x0000000000400000-0x000000000042A000-memory.dmp formbook behavioral2/memory/4340-27-0x0000000000400000-0x000000000042A000-memory.dmp formbook behavioral2/memory/5036-30-0x00000000008A0000-0x00000000008CA000-memory.dmp formbook behavioral2/memory/5036-35-0x00000000008A0000-0x00000000008CA000-memory.dmp formbook -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
f7e16970e5f6aec9ed1fb634bfee3269_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation f7e16970e5f6aec9ed1fb634bfee3269_JaffaCakes118.exe -
Executes dropped EXE 2 IoCs
Processes:
syscheck.exesyscheck.exepid process 972 syscheck.exe 4340 syscheck.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
syscheck.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysnet = "C:\\Users\\Admin\\AppData\\Local\\syscheck.exe -boot" syscheck.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
syscheck.exesyscheck.execmstp.exedescription pid process target process PID 972 set thread context of 4340 972 syscheck.exe syscheck.exe PID 4340 set thread context of 3328 4340 syscheck.exe Explorer.EXE PID 5036 set thread context of 3328 5036 cmstp.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 28 IoCs
Processes:
syscheck.execmstp.exepid process 4340 syscheck.exe 4340 syscheck.exe 4340 syscheck.exe 4340 syscheck.exe 5036 cmstp.exe 5036 cmstp.exe 5036 cmstp.exe 5036 cmstp.exe 5036 cmstp.exe 5036 cmstp.exe 5036 cmstp.exe 5036 cmstp.exe 5036 cmstp.exe 5036 cmstp.exe 5036 cmstp.exe 5036 cmstp.exe 5036 cmstp.exe 5036 cmstp.exe 5036 cmstp.exe 5036 cmstp.exe 5036 cmstp.exe 5036 cmstp.exe 5036 cmstp.exe 5036 cmstp.exe 5036 cmstp.exe 5036 cmstp.exe 5036 cmstp.exe 5036 cmstp.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
syscheck.execmstp.exepid process 4340 syscheck.exe 4340 syscheck.exe 4340 syscheck.exe 5036 cmstp.exe 5036 cmstp.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
f7e16970e5f6aec9ed1fb634bfee3269_JaffaCakes118.exesyscheck.exesyscheck.execmstp.exedescription pid process Token: SeDebugPrivilege 2188 f7e16970e5f6aec9ed1fb634bfee3269_JaffaCakes118.exe Token: SeDebugPrivilege 972 syscheck.exe Token: SeDebugPrivilege 4340 syscheck.exe Token: SeDebugPrivilege 5036 cmstp.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3328 Explorer.EXE -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
f7e16970e5f6aec9ed1fb634bfee3269_JaffaCakes118.execmd.exesyscheck.exeExplorer.EXEcmstp.exedescription pid process target process PID 2188 wrote to memory of 3180 2188 f7e16970e5f6aec9ed1fb634bfee3269_JaffaCakes118.exe cmd.exe PID 2188 wrote to memory of 3180 2188 f7e16970e5f6aec9ed1fb634bfee3269_JaffaCakes118.exe cmd.exe PID 2188 wrote to memory of 3180 2188 f7e16970e5f6aec9ed1fb634bfee3269_JaffaCakes118.exe cmd.exe PID 2188 wrote to memory of 5068 2188 f7e16970e5f6aec9ed1fb634bfee3269_JaffaCakes118.exe cmd.exe PID 2188 wrote to memory of 5068 2188 f7e16970e5f6aec9ed1fb634bfee3269_JaffaCakes118.exe cmd.exe PID 2188 wrote to memory of 5068 2188 f7e16970e5f6aec9ed1fb634bfee3269_JaffaCakes118.exe cmd.exe PID 5068 wrote to memory of 972 5068 cmd.exe syscheck.exe PID 5068 wrote to memory of 972 5068 cmd.exe syscheck.exe PID 5068 wrote to memory of 972 5068 cmd.exe syscheck.exe PID 972 wrote to memory of 4340 972 syscheck.exe syscheck.exe PID 972 wrote to memory of 4340 972 syscheck.exe syscheck.exe PID 972 wrote to memory of 4340 972 syscheck.exe syscheck.exe PID 972 wrote to memory of 4340 972 syscheck.exe syscheck.exe PID 972 wrote to memory of 4340 972 syscheck.exe syscheck.exe PID 972 wrote to memory of 4340 972 syscheck.exe syscheck.exe PID 3328 wrote to memory of 5036 3328 Explorer.EXE cmstp.exe PID 3328 wrote to memory of 5036 3328 Explorer.EXE cmstp.exe PID 3328 wrote to memory of 5036 3328 Explorer.EXE cmstp.exe PID 5036 wrote to memory of 3860 5036 cmstp.exe cmd.exe PID 5036 wrote to memory of 3860 5036 cmstp.exe cmd.exe PID 5036 wrote to memory of 3860 5036 cmstp.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f7e16970e5f6aec9ed1fb634bfee3269_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f7e16970e5f6aec9ed1fb634bfee3269_JaffaCakes118.exe"2⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\f7e16970e5f6aec9ed1fb634bfee3269_JaffaCakes118.exe" "C:\Users\Admin\AppData\Local\syscheck.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c, "C:\Users\Admin\AppData\Local\syscheck.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\syscheck.exe"C:\Users\Admin\AppData\Local\syscheck.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\syscheck.exe"C:\Users\Admin\AppData\Local\syscheck.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\syscheck.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\syscheck.exeFilesize
483KB
MD5f7e16970e5f6aec9ed1fb634bfee3269
SHA1f939bfe961ac41b7a35f7763398d18248ffdf965
SHA2561f7b393e44ad6fcc5273bd57a21db95f4f20ca715cab20157455edd05f87f672
SHA512270f06a3ae1e17fe7db5e40c98b14d1f0be29f94921c6c357fc26be93d577d4e8564320ef010eceabfe4a9790fa9a2bcc0a5bebaf51e30b0cdd314a096e0779d
-
memory/972-22-0x00000000746C0000-0x0000000074E70000-memory.dmpFilesize
7.7MB
-
memory/972-18-0x0000000005950000-0x00000000059EC000-memory.dmpFilesize
624KB
-
memory/972-17-0x00000000746C0000-0x0000000074E70000-memory.dmpFilesize
7.7MB
-
memory/972-16-0x0000000004DB0000-0x0000000004DC0000-memory.dmpFilesize
64KB
-
memory/972-15-0x00000000746C0000-0x0000000074E70000-memory.dmpFilesize
7.7MB
-
memory/2188-4-0x0000000002620000-0x000000000263C000-memory.dmpFilesize
112KB
-
memory/2188-9-0x0000000004DB0000-0x0000000004DC0000-memory.dmpFilesize
64KB
-
memory/2188-11-0x00000000746C0000-0x0000000074E70000-memory.dmpFilesize
7.7MB
-
memory/2188-8-0x00000000746C0000-0x0000000074E70000-memory.dmpFilesize
7.7MB
-
memory/2188-5-0x0000000004DB0000-0x0000000004DC0000-memory.dmpFilesize
64KB
-
memory/2188-3-0x0000000004C30000-0x0000000004CC2000-memory.dmpFilesize
584KB
-
memory/2188-2-0x0000000005290000-0x0000000005834000-memory.dmpFilesize
5.6MB
-
memory/2188-0-0x0000000000320000-0x000000000039E000-memory.dmpFilesize
504KB
-
memory/2188-1-0x00000000746C0000-0x0000000074E70000-memory.dmpFilesize
7.7MB
-
memory/3328-37-0x0000000008D60000-0x0000000008E98000-memory.dmpFilesize
1.2MB
-
memory/3328-41-0x0000000008D60000-0x0000000008E98000-memory.dmpFilesize
1.2MB
-
memory/3328-38-0x0000000008D60000-0x0000000008E98000-memory.dmpFilesize
1.2MB
-
memory/3328-26-0x0000000003230000-0x0000000003304000-memory.dmpFilesize
848KB
-
memory/4340-19-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/4340-27-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/4340-25-0x0000000001130000-0x0000000001144000-memory.dmpFilesize
80KB
-
memory/4340-24-0x00000000011D0000-0x000000000151A000-memory.dmpFilesize
3.3MB
-
memory/5036-28-0x0000000000DB0000-0x0000000000DC6000-memory.dmpFilesize
88KB
-
memory/5036-29-0x0000000000DB0000-0x0000000000DC6000-memory.dmpFilesize
88KB
-
memory/5036-30-0x00000000008A0000-0x00000000008CA000-memory.dmpFilesize
168KB
-
memory/5036-31-0x00000000029F0000-0x0000000002D3A000-memory.dmpFilesize
3.3MB
-
memory/5036-33-0x0000000002690000-0x0000000002723000-memory.dmpFilesize
588KB
-
memory/5036-35-0x00000000008A0000-0x00000000008CA000-memory.dmpFilesize
168KB