Analysis
-
max time kernel
55s -
max time network
67s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
20-04-2024 22:22
Static task
static1
Behavioral task
behavioral1
Sample
fdc85013066a66d2b09cb9b8e0b8e2aa_JaffaCakes118.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
fdc85013066a66d2b09cb9b8e0b8e2aa_JaffaCakes118.exe
Resource
win10v2004-20240226-en
Errors
General
-
Target
fdc85013066a66d2b09cb9b8e0b8e2aa_JaffaCakes118.exe
-
Size
83KB
-
MD5
fdc85013066a66d2b09cb9b8e0b8e2aa
-
SHA1
e7b3ae4cf2eabb3522b2bbf0ba0c7238ac671a0b
-
SHA256
49785bd16ce8034cde002f71355446b51267696aeb9d422a6ed952ccf2c3605f
-
SHA512
abbc6b1d637eb2e6cba5e128ecb96ef07f72f2538db74ee9044f1d58033d458b4f089b0b8b7aa2f49f8e1c1d4d1fee775d1bfafa0e72ff245b871d0b08b4ed2d
-
SSDEEP
1536:GblagF9KIH+jege2ZEY7ayD32wM2Tl7nr5Ql9FOaB+hHU2GY:qTXKIdge2ZzjnVr66aAAY
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation fdc85013066a66d2b09cb9b8e0b8e2aa_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\269154324 = "C:\\Users\\Admin\\269154324.exe" reg.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 15 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "221" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2388 fdc85013066a66d2b09cb9b8e0b8e2aa_JaffaCakes118.exe Token: SeShutdownPrivilege 1092 shutdown.exe Token: SeRemoteShutdownPrivilege 1092 shutdown.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3684 LogonUI.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2388 wrote to memory of 2360 2388 fdc85013066a66d2b09cb9b8e0b8e2aa_JaffaCakes118.exe 91 PID 2388 wrote to memory of 2360 2388 fdc85013066a66d2b09cb9b8e0b8e2aa_JaffaCakes118.exe 91 PID 2388 wrote to memory of 2360 2388 fdc85013066a66d2b09cb9b8e0b8e2aa_JaffaCakes118.exe 91 PID 2360 wrote to memory of 3124 2360 cmd.exe 93 PID 2360 wrote to memory of 3124 2360 cmd.exe 93 PID 2360 wrote to memory of 3124 2360 cmd.exe 93 PID 2388 wrote to memory of 1092 2388 fdc85013066a66d2b09cb9b8e0b8e2aa_JaffaCakes118.exe 94 PID 2388 wrote to memory of 1092 2388 fdc85013066a66d2b09cb9b8e0b8e2aa_JaffaCakes118.exe 94 PID 2388 wrote to memory of 1092 2388 fdc85013066a66d2b09cb9b8e0b8e2aa_JaffaCakes118.exe 94 PID 2388 wrote to memory of 3200 2388 fdc85013066a66d2b09cb9b8e0b8e2aa_JaffaCakes118.exe 96 PID 2388 wrote to memory of 3200 2388 fdc85013066a66d2b09cb9b8e0b8e2aa_JaffaCakes118.exe 96 PID 2388 wrote to memory of 3200 2388 fdc85013066a66d2b09cb9b8e0b8e2aa_JaffaCakes118.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\fdc85013066a66d2b09cb9b8e0b8e2aa_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fdc85013066a66d2b09cb9b8e0b8e2aa_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Windows\SysWOW64\cmd.execmd.exe /c REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v 269154324 /t REG_SZ /d "%userprofile%\269154324.exe" /f2⤵
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Windows\SysWOW64\reg.exeREG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v 269154324 /t REG_SZ /d "C:\Users\Admin\269154324.exe" /f3⤵
- Adds Run key to start application
PID:3124
-
-
-
C:\Windows\SysWOW64\shutdown.exe"C:\Windows\System32\shutdown.exe" /r /f /t 32⤵
- Suspicious use of AdjustPrivilegeToken
PID:1092
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\FDC850~1.EXE > nul2⤵PID:3200
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa39fc055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3684