Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
19-04-2024 10:25
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
fa193e8424632650cfeb7cd1333300d2_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
fa193e8424632650cfeb7cd1333300d2_JaffaCakes118.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
fa193e8424632650cfeb7cd1333300d2_JaffaCakes118.exe
-
Size
1.4MB
-
MD5
fa193e8424632650cfeb7cd1333300d2
-
SHA1
6672fd7e5ee448f2bdd40a51f7cb8ab5443312fc
-
SHA256
353de44681cf517321aad71ae5c0827540169c2f5ca2a0e5b6457f7af07ce1bf
-
SHA512
439a2c820776a863216a0b30cd159235e5e3f4aabb428b90734ab0a2eb4cd39c2b2b54fdd6612abd159768e309e2937da024168337387d2b0166a667e3220f9b
-
SSDEEP
24576:9L7r/4p6qO4pDlPJsZtZQk5p8hulbEwfDpBzjRvdsxlTShiVN/5:J/4Qf4pxPctqG8IllnxvdsxZ4UV5
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation fa193e8424632650cfeb7cd1333300d2_JaffaCakes118.exe -
Loads dropped DLL 8 IoCs
pid Process 1948 fa193e8424632650cfeb7cd1333300d2_JaffaCakes118.exe 1948 fa193e8424632650cfeb7cd1333300d2_JaffaCakes118.exe 1948 fa193e8424632650cfeb7cd1333300d2_JaffaCakes118.exe 1948 fa193e8424632650cfeb7cd1333300d2_JaffaCakes118.exe 1948 fa193e8424632650cfeb7cd1333300d2_JaffaCakes118.exe 1948 fa193e8424632650cfeb7cd1333300d2_JaffaCakes118.exe 1948 fa193e8424632650cfeb7cd1333300d2_JaffaCakes118.exe 1948 fa193e8424632650cfeb7cd1333300d2_JaffaCakes118.exe -
Drops file in Program Files directory 18 IoCs
description ioc Process File created C:\Program Files (x86)\jishu_134108\sc\²ÊƱ¿ª½±²éѯ-ÔÚÏßÂò²ÊƱ.url fa193e8424632650cfeb7cd1333300d2_JaffaCakes118.exe File created C:\Program Files (x86)\jishu_134108\sc\ÍøÉϹºÎïÍøÖ·´óÈ«-Íø¹ºµÚÒ»Õ¾.url fa193e8424632650cfeb7cd1333300d2_JaffaCakes118.exe File created C:\Program Files (x86)\soft134108\a fa193e8424632650cfeb7cd1333300d2_JaffaCakes118.exe File created C:\Program Files (x86)\soft134108\MiniJJ_12318.exe fa193e8424632650cfeb7cd1333300d2_JaffaCakes118.exe File created C:\Program Files (x86)\soft134108\pipi_dae_381.exe fa193e8424632650cfeb7cd1333300d2_JaffaCakes118.exe File created C:\Program Files (x86)\jishu_134108\newnew.ini fa193e8424632650cfeb7cd1333300d2_JaffaCakes118.exe File created C:\Program Files (x86)\jishu_134108\ImgCache\www.2144.net_favicon.ico fa193e8424632650cfeb7cd1333300d2_JaffaCakes118.exe File created C:\Program Files (x86)\jishu_134108\sc\2144СÓÎÏ·--³¬¼¶ºÃÍ棬ÀֺǺÇ.url fa193e8424632650cfeb7cd1333300d2_JaffaCakes118.exe File created C:\Program Files (x86)\jishu_134108\sc\GoogleËÑË÷.url fa193e8424632650cfeb7cd1333300d2_JaffaCakes118.exe File created C:\Program Files (x86)\jishu_134108\sc\ÿÌìÍŹºÒ»ÏÂ-¾Û±ãÒË.url fa193e8424632650cfeb7cd1333300d2_JaffaCakes118.exe File created C:\Program Files (x86)\jishu_134108\FlashIcon.ico fa193e8424632650cfeb7cd1333300d2_JaffaCakes118.exe File created C:\Program Files (x86)\jishu_134108\newnew.exe fa193e8424632650cfeb7cd1333300d2_JaffaCakes118.exe File created C:\Program Files (x86)\soft134108\0820110805080819410813080808.txt fa193e8424632650cfeb7cd1333300d2_JaffaCakes118.exe File created C:\Program Files (x86)\soft134108\wl06079.exe fa193e8424632650cfeb7cd1333300d2_JaffaCakes118.exe File created C:\Program Files (x86)\jishu_134108\sc\126ÍøÖ·´óÈ«ÉÏÍø×î·½±ã.url fa193e8424632650cfeb7cd1333300d2_JaffaCakes118.exe File created C:\Program Files (x86)\jishu_134108\sc\»Æ¹ÏµçÓ°Íø-ÔÚÏßµçÓ°.url fa193e8424632650cfeb7cd1333300d2_JaffaCakes118.exe File created C:\Program Files (x86)\jishu_134108\dailytips.ini fa193e8424632650cfeb7cd1333300d2_JaffaCakes118.exe File created C:\Program Files (x86)\soft134108\d_1308.exe fa193e8424632650cfeb7cd1333300d2_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20e898cb4792da01 IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420288930" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3268612713" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31101511" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31101511" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000037d9fd2fc29e2346b2a08d538ac48f6600000000020000000000106600000001000020000000594ca48a804775d1c7386830f7fcef52635d8dd44d746eaf68361133230f8139000000000e8000000002000020000000fd94e922ca3ab90a6ee46518c0e90caef1b8147a54ca6fb2532f10bb6fb7005e20000000a680c846c322ec4588fa4e9c1a7d26c5db1ac09b419ccf864ff780fd21ea646f40000000d09bd5119113473893328f890f13585266183e8875ba8822d040f7e871040d80319765b589d1712e32cbcdc1bd726728d0a440202b781f49e7a4be53e718f78a IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3268612713" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1014a0cb4792da01 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31101511" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3270800043" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{EE7571D0-FE3A-11EE-8A9B-5E05BE2BF3AB} = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000037d9fd2fc29e2346b2a08d538ac48f6600000000020000000000106600000001000020000000c604cc0edc0a282a6cd5a564b176a40aa281658bd6da6e240ce9fc9bdc34c8c0000000000e8000000002000020000000fa7b298443ac3366654fbbdc4467a3b185cc9a64c2bae8394a16206a71cf9bef20000000966de536eccad8f5fd04ac2ffa1068d7124691a9d5fa45f33d1528ff1653c9a040000000207b9d327435f695dad16240652db3a6d908ddeef0a9b4e8c08009a99209871180f794836e880913264f15b375cc872a8e2d7e9e90d313bc6fcce554ab36af11 IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1948 fa193e8424632650cfeb7cd1333300d2_JaffaCakes118.exe 1948 fa193e8424632650cfeb7cd1333300d2_JaffaCakes118.exe 1948 fa193e8424632650cfeb7cd1333300d2_JaffaCakes118.exe 1948 fa193e8424632650cfeb7cd1333300d2_JaffaCakes118.exe 1948 fa193e8424632650cfeb7cd1333300d2_JaffaCakes118.exe 1948 fa193e8424632650cfeb7cd1333300d2_JaffaCakes118.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3064 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3064 IEXPLORE.EXE 3064 IEXPLORE.EXE 2468 IEXPLORE.EXE 2468 IEXPLORE.EXE 2468 IEXPLORE.EXE 2468 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1948 wrote to memory of 2688 1948 fa193e8424632650cfeb7cd1333300d2_JaffaCakes118.exe 85 PID 1948 wrote to memory of 2688 1948 fa193e8424632650cfeb7cd1333300d2_JaffaCakes118.exe 85 PID 1948 wrote to memory of 2688 1948 fa193e8424632650cfeb7cd1333300d2_JaffaCakes118.exe 85 PID 2688 wrote to memory of 3064 2688 IEXPLORE.EXE 86 PID 2688 wrote to memory of 3064 2688 IEXPLORE.EXE 86 PID 1948 wrote to memory of 4540 1948 fa193e8424632650cfeb7cd1333300d2_JaffaCakes118.exe 87 PID 1948 wrote to memory of 4540 1948 fa193e8424632650cfeb7cd1333300d2_JaffaCakes118.exe 87 PID 1948 wrote to memory of 4540 1948 fa193e8424632650cfeb7cd1333300d2_JaffaCakes118.exe 87 PID 1948 wrote to memory of 2012 1948 fa193e8424632650cfeb7cd1333300d2_JaffaCakes118.exe 88 PID 1948 wrote to memory of 2012 1948 fa193e8424632650cfeb7cd1333300d2_JaffaCakes118.exe 88 PID 1948 wrote to memory of 2012 1948 fa193e8424632650cfeb7cd1333300d2_JaffaCakes118.exe 88 PID 4540 wrote to memory of 3776 4540 IEXPLORE.EXE 89 PID 4540 wrote to memory of 3776 4540 IEXPLORE.EXE 89 PID 3064 wrote to memory of 2468 3064 IEXPLORE.EXE 90 PID 3064 wrote to memory of 2468 3064 IEXPLORE.EXE 90 PID 3064 wrote to memory of 2468 3064 IEXPLORE.EXE 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\fa193e8424632650cfeb7cd1333300d2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fa193e8424632650cfeb7cd1333300d2_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" http://taourl.com/6jb4v2⤵
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://taourl.com/6jb4v3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3064 CREDAT:17410 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2468
-
-
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" http://www.178gg.com/lianjie/10608.htm2⤵
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://www.178gg.com/lianjie/10608.htm3⤵
- Modifies Internet Explorer settings
PID:3776
-
-
-
C:\Windows\SysWOW64\Wscript.exe"C:\Windows\system32\Wscript" "C:\Program Files (x86)\soft134108\b_1308.vbs"2⤵PID:2012
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
MD5e2590fb7bac27dbfa512820e9139f28b
SHA1209d8d0b77c7a8863a3c68464ce47f6a3f00d454
SHA2564369c213390dd318aaf57b841e338f0b781b16e61713c39e3d961d6065de1821
SHA512a6b8cdac512c2d05eb2270f8b4f64248cc177785acbd8d4f0ad725acdd2c894f639e7e7259066a8014a79d69f213812dc09793a2bad7a3d6bd9a511f3ee57223
-
Filesize
226B
MD58a9d001191085f3900808d418faf4840
SHA10cfb3c7adb64da1640fac02745cb2caec39d77e1
SHA25602bc6610cfda293b6794f66a850bd6d8407a4d8c9b2d224cb960bf39c9707885
SHA5126edf9a381cb487f98e1c4d1cdf385ec207437a43a7519a34271496ddae04b25d2e679a7d94d12ba6d41fdc289ebee31f5fec5423f463fbabf08ae59e0d848f90
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
31KB
MD583cd62eab980e3d64c131799608c8371
SHA15b57a6842a154997e31fab573c5754b358f5dd1c
SHA256a6122e80f1c51dc72770b4f56c7c482f7a9571143fbf83b19c4d141d0cb19294
SHA51291cfbcc125600ec341f5571dcf1e4a814cf7673f82cf42f32155bd54791bbf32619f2bb14ae871d7996e9ddecdfcc5db40caa0979d6dfba3e73cfe8e69c163c9
-
Filesize
14KB
MD5254f13dfd61c5b7d2119eb2550491e1d
SHA15083f6804ee3475f3698ab9e68611b0128e22fd6
SHA256fd0e8be2135f3d326b65520383a3468c3983fa32c9c93594d986b16709d80f28
SHA512fcef8ac5bd0ee6e316dbbc128a223ba18c8bf85a8d253e0c0877af6a4f686a20b08d34e5a426e2be5045962b391b8073769253a4d9b18616febc8133ccf654f7