Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
20-04-2024 08:29
Behavioral task
behavioral1
Sample
fc5820cc6f4ee06de47249ec8ed3afc1_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fc5820cc6f4ee06de47249ec8ed3afc1_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
fc5820cc6f4ee06de47249ec8ed3afc1_JaffaCakes118.exe
-
Size
525KB
-
MD5
fc5820cc6f4ee06de47249ec8ed3afc1
-
SHA1
e8eec4be470d99387a35794b0594b19c59ad73b0
-
SHA256
a17e76adefe08655eca8c581023081940aeb170343d8307470ba6de47e925d8c
-
SHA512
c7938c4204138d1e3095a8fb8d15f5ed2b525b049164f20bb5f4dced54da3c2eee8e2e051d64626164e5e9279590d481d4f5ae97f084cf9d52b26ccf619868dc
-
SSDEEP
6144:C7fy6Ezozt81ENRd3Qs1OUdK8N+VQs7PlWlBjPKXPXwboCTms51t1wZXzYEGgJrF:/bt1kRdAs1OYKPlWlBjifyPTmfWq
Malware Config
Signatures
-
Blocklisted process makes network request 8 IoCs
Processes:
rundll32.exeflow pid process 14 2196 rundll32.exe 23 2196 rundll32.exe 24 2196 rundll32.exe 51 2196 rundll32.exe 68 2196 rundll32.exe 106 2196 rundll32.exe 149 2196 rundll32.exe 195 2196 rundll32.exe -
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
Processes:
resource yara_rule \??\c:\vabcu\bwjci.wcb acprotect -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation rundll32.exe -
Deletes itself 1 IoCs
Processes:
bodsa.exepid process 2404 bodsa.exe -
Executes dropped EXE 2 IoCs
Processes:
bodsa.exewiseman.exepid process 2404 bodsa.exe 3744 wiseman.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 2196 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\bodsa.exe upx \??\c:\vabcu\bwjci.wcb upx behavioral2/memory/2196-8-0x0000000010000000-0x000000001002A000-memory.dmp upx behavioral2/memory/2196-11-0x0000000010000000-0x000000001002A000-memory.dmp upx behavioral2/memory/2196-13-0x0000000010000000-0x000000001002A000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
wiseman.exerundll32.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Wiseman = "C:\\wiseman.exe" wiseman.exe Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\EvtMgr = "c:\\windows\\SysWOW64\\rundll32.exe \"c:\\vabcu\\bwjci.wcb\",XML_MemFree" rundll32.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
rundll32.exedescription ioc process File opened (read-only) \??\l: rundll32.exe File opened (read-only) \??\m: rundll32.exe File opened (read-only) \??\q: rundll32.exe File opened (read-only) \??\a: rundll32.exe File opened (read-only) \??\g: rundll32.exe File opened (read-only) \??\h: rundll32.exe File opened (read-only) \??\j: rundll32.exe File opened (read-only) \??\y: rundll32.exe File opened (read-only) \??\z: rundll32.exe File opened (read-only) \??\b: rundll32.exe File opened (read-only) \??\o: rundll32.exe File opened (read-only) \??\p: rundll32.exe File opened (read-only) \??\v: rundll32.exe File opened (read-only) \??\w: rundll32.exe File opened (read-only) \??\e: rundll32.exe File opened (read-only) \??\k: rundll32.exe File opened (read-only) \??\s: rundll32.exe File opened (read-only) \??\u: rundll32.exe File opened (read-only) \??\x: rundll32.exe File opened (read-only) \??\i: rundll32.exe File opened (read-only) \??\n: rundll32.exe File opened (read-only) \??\r: rundll32.exe File opened (read-only) \??\t: rundll32.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
rundll32.exedescription ioc process File opened for modification \??\PHYSICALDRIVE0 rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 1640 taskkill.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
rundll32.exepid process 2196 rundll32.exe 2196 rundll32.exe 2196 rundll32.exe 2196 rundll32.exe 2196 rundll32.exe 2196 rundll32.exe 2196 rundll32.exe 2196 rundll32.exe 2196 rundll32.exe 2196 rundll32.exe 2196 rundll32.exe 2196 rundll32.exe 2196 rundll32.exe 2196 rundll32.exe 2196 rundll32.exe 2196 rundll32.exe 2196 rundll32.exe 2196 rundll32.exe 2196 rundll32.exe 2196 rundll32.exe 2196 rundll32.exe 2196 rundll32.exe 2196 rundll32.exe 2196 rundll32.exe 2196 rundll32.exe 2196 rundll32.exe 2196 rundll32.exe 2196 rundll32.exe 2196 rundll32.exe 2196 rundll32.exe 2196 rundll32.exe 2196 rundll32.exe 2196 rundll32.exe 2196 rundll32.exe 2196 rundll32.exe 2196 rundll32.exe 2196 rundll32.exe 2196 rundll32.exe 2196 rundll32.exe 2196 rundll32.exe 2196 rundll32.exe 2196 rundll32.exe 2196 rundll32.exe 2196 rundll32.exe 2196 rundll32.exe 2196 rundll32.exe 2196 rundll32.exe 2196 rundll32.exe 2196 rundll32.exe 2196 rundll32.exe 2196 rundll32.exe 2196 rundll32.exe 2196 rundll32.exe 2196 rundll32.exe 2196 rundll32.exe 2196 rundll32.exe 2196 rundll32.exe 2196 rundll32.exe 2196 rundll32.exe 2196 rundll32.exe 2196 rundll32.exe 2196 rundll32.exe 2196 rundll32.exe 2196 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
rundll32.exetaskkill.exedescription pid process Token: SeDebugPrivilege 2196 rundll32.exe Token: SeDebugPrivilege 1640 taskkill.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
fc5820cc6f4ee06de47249ec8ed3afc1_JaffaCakes118.exebodsa.exewiseman.exepid process 544 fc5820cc6f4ee06de47249ec8ed3afc1_JaffaCakes118.exe 2404 bodsa.exe 3744 wiseman.exe 3744 wiseman.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
fc5820cc6f4ee06de47249ec8ed3afc1_JaffaCakes118.execmd.exebodsa.exerundll32.exedescription pid process target process PID 544 wrote to memory of 4228 544 fc5820cc6f4ee06de47249ec8ed3afc1_JaffaCakes118.exe cmd.exe PID 544 wrote to memory of 4228 544 fc5820cc6f4ee06de47249ec8ed3afc1_JaffaCakes118.exe cmd.exe PID 544 wrote to memory of 4228 544 fc5820cc6f4ee06de47249ec8ed3afc1_JaffaCakes118.exe cmd.exe PID 4228 wrote to memory of 4924 4228 cmd.exe PING.EXE PID 4228 wrote to memory of 4924 4228 cmd.exe PING.EXE PID 4228 wrote to memory of 4924 4228 cmd.exe PING.EXE PID 4228 wrote to memory of 2404 4228 cmd.exe bodsa.exe PID 4228 wrote to memory of 2404 4228 cmd.exe bodsa.exe PID 4228 wrote to memory of 2404 4228 cmd.exe bodsa.exe PID 2404 wrote to memory of 2196 2404 bodsa.exe rundll32.exe PID 2404 wrote to memory of 2196 2404 bodsa.exe rundll32.exe PID 2404 wrote to memory of 2196 2404 bodsa.exe rundll32.exe PID 2196 wrote to memory of 1640 2196 rundll32.exe taskkill.exe PID 2196 wrote to memory of 1640 2196 rundll32.exe taskkill.exe PID 2196 wrote to memory of 1640 2196 rundll32.exe taskkill.exe PID 2196 wrote to memory of 3744 2196 rundll32.exe wiseman.exe PID 2196 wrote to memory of 3744 2196 rundll32.exe wiseman.exe PID 2196 wrote to memory of 3744 2196 rundll32.exe wiseman.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fc5820cc6f4ee06de47249ec8ed3afc1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fc5820cc6f4ee06de47249ec8ed3afc1_JaffaCakes118.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 -n 2&C:\Users\Admin\AppData\Local\Temp\\bodsa.exe "C:\Users\Admin\AppData\Local\Temp\fc5820cc6f4ee06de47249ec8ed3afc1_JaffaCakes118.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 23⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\bodsa.exeC:\Users\Admin\AppData\Local\Temp\\bodsa.exe "C:\Users\Admin\AppData\Local\Temp\fc5820cc6f4ee06de47249ec8ed3afc1_JaffaCakes118.exe"3⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\vabcu\bwjci.wcb",XML_MemFree C:\Users\Admin\AppData\Local\Temp\bodsa.exe4⤵
- Blocklisted process makes network request
- Checks computer location settings
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\taskkill.exetaskkill /f /im attrib.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\wiseman.exe"C:\wiseman.exe"5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\bodsa.exeFilesize
525KB
MD50ccdf153b514394ca820a6ef50c311af
SHA1328fb243e968258ffdb403948913c346e11b7997
SHA2568f44a3b3048661cd1bfbb868c25e12e54e17c3c4ec77db929a73501808a1d059
SHA51292c22ad950bfb4d536db2517185dd729147a75434e2ca3d0767e5c77eb1625d52dc592f05b498c539bc86bcaa8423c8ec35b8cecadc4012b7d377cc416de25db
-
C:\wiseman.exeFilesize
378KB
MD58f242369cf14f2b26ced131d7dd67144
SHA1d4f2f0f3047300ff5f36af6119ad5e109258fcd0
SHA25603505198d487e04a8ec82c627d34e4d9145f211140c4c8793b4461621e6bf6ce
SHA5124516b3fa2f68e64baf166bc7731ba3bb0ca53d36d71ff8fa78b1f211d7c14fc4442af50bd637d0c3f11913583c9c66996101d6e8738592a053e82a78bbd771f5
-
\??\c:\vabcu\bwjci.wcbFilesize
62KB
MD5fb1d904d905d0f177e0fe9d0ac8a44a5
SHA1c3b5ce7e61697e8e604cde525770e002175f2f96
SHA25649d6d364a910ad716fa3ad6229479b2af0f0451ed41e9adc7d8537801cd67c2a
SHA51207bc9a2f0281fa6f99d5a0554190fa5671fc2c8bf1029f22745ddc73f33d7f57850104aec3d83c131f870b2f5197831a9e7f073f10596560c3117d2a37935647
-
memory/2196-8-0x0000000010000000-0x000000001002A000-memory.dmpFilesize
168KB
-
memory/2196-11-0x0000000010000000-0x000000001002A000-memory.dmpFilesize
168KB
-
memory/2196-13-0x0000000010000000-0x000000001002A000-memory.dmpFilesize
168KB