Analysis
-
max time kernel
148s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
19-04-2024 09:35
Static task
static1
Behavioral task
behavioral1
Sample
fa0498dfaa228009445e8c95883ed476_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fa0498dfaa228009445e8c95883ed476_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
fa0498dfaa228009445e8c95883ed476_JaffaCakes118.exe
-
Size
476KB
-
MD5
fa0498dfaa228009445e8c95883ed476
-
SHA1
b3526e8d44cd102aa74617f70a4908134b4469cb
-
SHA256
73fee5055bb68a988bf02e90cf1d52f156e023737c447d57e192ce4c4ab45bbd
-
SHA512
e3af5cc6c9b9ac9f843d9e7587654c183e3712d17ccf94d094f7af2280eb9cfeec4441acbfc2c70061a069ce1df19c500dbd72aadcfd66b8cd8fe835398bfe82
-
SSDEEP
12288:YKmpj7KDe1eK36A0txbw6jJmDV54VK+LeDi5MQs:hGjHJ6BtuU8uam5M5
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
fa0498dfaa228009445e8c95883ed476_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\Control Panel\International\Geo\Nation fa0498dfaa228009445e8c95883ed476_JaffaCakes118.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
fa0498dfaa228009445e8c95883ed476_JaffaCakes118.exedescription ioc process File opened for modification \??\PhysicalDrive0 fa0498dfaa228009445e8c95883ed476_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
fa0498dfaa228009445e8c95883ed476_JaffaCakes118.exedescription pid process target process PID 1832 set thread context of 1528 1832 fa0498dfaa228009445e8c95883ed476_JaffaCakes118.exe fa0498dfaa228009445e8c95883ed476_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
fa0498dfaa228009445e8c95883ed476_JaffaCakes118.exepid process 1832 fa0498dfaa228009445e8c95883ed476_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
fa0498dfaa228009445e8c95883ed476_JaffaCakes118.exedescription pid process target process PID 1832 wrote to memory of 1528 1832 fa0498dfaa228009445e8c95883ed476_JaffaCakes118.exe fa0498dfaa228009445e8c95883ed476_JaffaCakes118.exe PID 1832 wrote to memory of 1528 1832 fa0498dfaa228009445e8c95883ed476_JaffaCakes118.exe fa0498dfaa228009445e8c95883ed476_JaffaCakes118.exe PID 1832 wrote to memory of 1528 1832 fa0498dfaa228009445e8c95883ed476_JaffaCakes118.exe fa0498dfaa228009445e8c95883ed476_JaffaCakes118.exe PID 1832 wrote to memory of 1528 1832 fa0498dfaa228009445e8c95883ed476_JaffaCakes118.exe fa0498dfaa228009445e8c95883ed476_JaffaCakes118.exe PID 1832 wrote to memory of 1528 1832 fa0498dfaa228009445e8c95883ed476_JaffaCakes118.exe fa0498dfaa228009445e8c95883ed476_JaffaCakes118.exe PID 1832 wrote to memory of 1528 1832 fa0498dfaa228009445e8c95883ed476_JaffaCakes118.exe fa0498dfaa228009445e8c95883ed476_JaffaCakes118.exe PID 1832 wrote to memory of 1528 1832 fa0498dfaa228009445e8c95883ed476_JaffaCakes118.exe fa0498dfaa228009445e8c95883ed476_JaffaCakes118.exe PID 1832 wrote to memory of 1528 1832 fa0498dfaa228009445e8c95883ed476_JaffaCakes118.exe fa0498dfaa228009445e8c95883ed476_JaffaCakes118.exe PID 1832 wrote to memory of 1528 1832 fa0498dfaa228009445e8c95883ed476_JaffaCakes118.exe fa0498dfaa228009445e8c95883ed476_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fa0498dfaa228009445e8c95883ed476_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fa0498dfaa228009445e8c95883ed476_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\fa0498dfaa228009445e8c95883ed476_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\fa0498dfaa228009445e8c95883ed476_JaffaCakes118.exe2⤵PID:1528
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\124.exeFilesize
1KB
MD55343c1a8b203c162a3bf3870d9f50fd4
SHA104b5b886c20d88b57eea6d8ff882624a4ac1e51d
SHA256dc1d54dab6ec8c00f70137927504e4f222c8395f10760b6beecfcfa94e08249f
SHA512e0f50acb6061744e825a4051765cebf23e8c489b55b190739409d8a79bb08dac8f919247a4e5f65a015ea9c57d326bbef7ea045163915129e01f316c4958d949
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-776854024-226333264-2052258302-1000\699c4b9cdebca7aaea5193cae8a50098_9ea0183e-45ac-42a1-bca6-f2ab73e3e93bFilesize
50B
MD55b63d4dd8c04c88c0e30e494ec6a609a
SHA1884d5a8bdc25fe794dc22ef9518009dcf0069d09
SHA2564d93c22555b3169e5c13716ca59b8b22892c69b3025aea841afe5259698102fd
SHA51215ff8551ac6b9de978050569bcdc26f44dfc06a0eaf445ac70fd45453a21bdafa3e4c8b4857d6a1c3226f4102a639682bdfb71d7b255062fb81a51c9126896cb
-
memory/1528-3-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/1528-9-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/1528-10-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/1528-13-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB