Analysis
-
max time kernel
147s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
20-04-2024 15:39
Static task
static1
Behavioral task
behavioral1
Sample
fd18ba08ec4efdb271129a78c5f7af50_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fd18ba08ec4efdb271129a78c5f7af50_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
fd18ba08ec4efdb271129a78c5f7af50_JaffaCakes118.exe
-
Size
415KB
-
MD5
fd18ba08ec4efdb271129a78c5f7af50
-
SHA1
89a75480e463d9de61361652bde3cfd208101f5d
-
SHA256
f1425cd71a831c0b4ad77377d0919a7a59579b88542f1793fbd3251ad27b0c5c
-
SHA512
c94cf1c5773b8c4d424b66726fa2210dd00fa74768df459eee373e40b057614e83f3eff47693e2cbd0beb5eaa7161a4cafd50daa523c3774879ebc798f4094c6
-
SSDEEP
12288:3kWAehJuqTSadZgvzQE6Sev90DxufO1iuxk+j:3kWAAuq2aEUE6SevAwmUuxkO
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
fd18ba08ec4efdb271129a78c5f7af50_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation fd18ba08ec4efdb271129a78c5f7af50_JaffaCakes118.exe -
Executes dropped EXE 2 IoCs
Processes:
pic.exepic.exepid process 860 pic.exe 748 pic.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
pic.exedescription pid process target process PID 860 set thread context of 748 860 pic.exe pic.exe PID 860 set thread context of 0 860 pic.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 3 IoCs
Processes:
pic.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" pic.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key pic.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ pic.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
pic.exepid process 748 pic.exe 748 pic.exe 748 pic.exe 748 pic.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
pic.exepid process 860 pic.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
fd18ba08ec4efdb271129a78c5f7af50_JaffaCakes118.exepic.exepic.exedescription pid process target process PID 4984 wrote to memory of 860 4984 fd18ba08ec4efdb271129a78c5f7af50_JaffaCakes118.exe pic.exe PID 4984 wrote to memory of 860 4984 fd18ba08ec4efdb271129a78c5f7af50_JaffaCakes118.exe pic.exe PID 4984 wrote to memory of 860 4984 fd18ba08ec4efdb271129a78c5f7af50_JaffaCakes118.exe pic.exe PID 860 wrote to memory of 748 860 pic.exe pic.exe PID 860 wrote to memory of 748 860 pic.exe pic.exe PID 860 wrote to memory of 748 860 pic.exe pic.exe PID 860 wrote to memory of 748 860 pic.exe pic.exe PID 860 wrote to memory of 748 860 pic.exe pic.exe PID 860 wrote to memory of 748 860 pic.exe pic.exe PID 860 wrote to memory of 748 860 pic.exe pic.exe PID 860 wrote to memory of 0 860 pic.exe PID 860 wrote to memory of 0 860 pic.exe PID 860 wrote to memory of 0 860 pic.exe PID 860 wrote to memory of 0 860 pic.exe PID 748 wrote to memory of 3336 748 pic.exe Explorer.EXE PID 748 wrote to memory of 3336 748 pic.exe Explorer.EXE PID 748 wrote to memory of 3336 748 pic.exe Explorer.EXE PID 748 wrote to memory of 3336 748 pic.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\fd18ba08ec4efdb271129a78c5f7af50_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fd18ba08ec4efdb271129a78c5f7af50_JaffaCakes118.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\pic.exe"C:\pic.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\pic.exe"C:\\pic.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\pic.exeFilesize
256KB
MD506ea03ddcd093ba05485ce95811eabe4
SHA10610485fa9d4a34e794aceacfe98a269f2b4449b
SHA256ce8356e2474a416657d48e17e6e14d2dadde4c160ee00e1d044c1d29972f839f
SHA512ea81b7af0a694f7b5db6b65577f56ef0ab643ab93195f027687ef1716314c916296587ed4dd880c369098988405e693d3dd1fdeec29fb0da714babf774f977cb
-
memory/748-68-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/748-72-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/748-73-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/748-74-0x0000000010000000-0x0000000010013000-memory.dmpFilesize
76KB
-
memory/748-81-0x0000000010000000-0x0000000010013000-memory.dmpFilesize
76KB
-
memory/860-38-0x0000000000730000-0x000000000074B000-memory.dmpFilesize
108KB
-
memory/860-70-0x0000000000400000-0x00000000004A3000-memory.dmpFilesize
652KB
-
memory/860-16-0x0000000000730000-0x0000000000731000-memory.dmpFilesize
4KB
-
memory/860-17-0x0000000000730000-0x0000000000731000-memory.dmpFilesize
4KB
-
memory/860-18-0x0000000000730000-0x0000000000731000-memory.dmpFilesize
4KB
-
memory/860-20-0x0000000000730000-0x000000000074B000-memory.dmpFilesize
108KB
-
memory/860-19-0x0000000000730000-0x0000000000731000-memory.dmpFilesize
4KB
-
memory/860-21-0x0000000000730000-0x000000000074B000-memory.dmpFilesize
108KB
-
memory/860-22-0x0000000000730000-0x000000000074B000-memory.dmpFilesize
108KB
-
memory/860-24-0x0000000000730000-0x000000000074B000-memory.dmpFilesize
108KB
-
memory/860-23-0x0000000000730000-0x000000000074B000-memory.dmpFilesize
108KB
-
memory/860-25-0x0000000000730000-0x000000000074B000-memory.dmpFilesize
108KB
-
memory/860-26-0x0000000000730000-0x000000000074B000-memory.dmpFilesize
108KB
-
memory/860-28-0x0000000000730000-0x000000000074B000-memory.dmpFilesize
108KB
-
memory/860-27-0x0000000000730000-0x000000000074B000-memory.dmpFilesize
108KB
-
memory/860-29-0x0000000000730000-0x000000000074B000-memory.dmpFilesize
108KB
-
memory/860-30-0x0000000000730000-0x000000000074B000-memory.dmpFilesize
108KB
-
memory/860-31-0x0000000000730000-0x000000000074B000-memory.dmpFilesize
108KB
-
memory/860-32-0x0000000000730000-0x000000000074B000-memory.dmpFilesize
108KB
-
memory/860-33-0x0000000000730000-0x000000000074B000-memory.dmpFilesize
108KB
-
memory/860-34-0x0000000000730000-0x000000000074B000-memory.dmpFilesize
108KB
-
memory/860-35-0x0000000000730000-0x000000000074B000-memory.dmpFilesize
108KB
-
memory/860-40-0x0000000000730000-0x000000000074B000-memory.dmpFilesize
108KB
-
memory/860-36-0x0000000000730000-0x000000000074B000-memory.dmpFilesize
108KB
-
memory/860-14-0x0000000000400000-0x00000000004A3000-memory.dmpFilesize
652KB
-
memory/860-39-0x0000000000730000-0x000000000074B000-memory.dmpFilesize
108KB
-
memory/860-37-0x0000000000730000-0x000000000074B000-memory.dmpFilesize
108KB
-
memory/860-15-0x0000000000730000-0x0000000000731000-memory.dmpFilesize
4KB
-
memory/860-52-0x0000000000730000-0x000000000074B000-memory.dmpFilesize
108KB
-
memory/860-42-0x0000000000730000-0x000000000074B000-memory.dmpFilesize
108KB
-
memory/860-44-0x0000000000730000-0x000000000074B000-memory.dmpFilesize
108KB
-
memory/860-49-0x0000000000730000-0x000000000074B000-memory.dmpFilesize
108KB
-
memory/860-48-0x0000000000730000-0x000000000074B000-memory.dmpFilesize
108KB
-
memory/860-47-0x0000000000730000-0x000000000074B000-memory.dmpFilesize
108KB
-
memory/860-46-0x0000000000730000-0x000000000074B000-memory.dmpFilesize
108KB
-
memory/860-45-0x0000000000730000-0x000000000074B000-memory.dmpFilesize
108KB
-
memory/860-50-0x0000000000730000-0x000000000074B000-memory.dmpFilesize
108KB
-
memory/860-43-0x0000000000730000-0x000000000074B000-memory.dmpFilesize
108KB
-
memory/860-53-0x0000000000730000-0x000000000074B000-memory.dmpFilesize
108KB
-
memory/860-51-0x0000000000730000-0x000000000074B000-memory.dmpFilesize
108KB
-
memory/860-54-0x0000000000730000-0x000000000074B000-memory.dmpFilesize
108KB
-
memory/860-58-0x0000000000730000-0x000000000074B000-memory.dmpFilesize
108KB
-
memory/860-57-0x0000000000730000-0x000000000074B000-memory.dmpFilesize
108KB
-
memory/860-59-0x0000000000730000-0x000000000074B000-memory.dmpFilesize
108KB
-
memory/860-56-0x0000000000730000-0x000000000074B000-memory.dmpFilesize
108KB
-
memory/860-62-0x0000000000730000-0x000000000074B000-memory.dmpFilesize
108KB
-
memory/860-61-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/860-60-0x0000000000730000-0x000000000074B000-memory.dmpFilesize
108KB
-
memory/860-55-0x0000000000730000-0x000000000074B000-memory.dmpFilesize
108KB
-
memory/860-64-0x0000000000720000-0x0000000000721000-memory.dmpFilesize
4KB
-
memory/860-63-0x0000000000400000-0x00000000004A3000-memory.dmpFilesize
652KB
-
memory/860-66-0x0000000000400000-0x00000000004A3000-memory.dmpFilesize
652KB
-
memory/860-41-0x0000000000730000-0x000000000074B000-memory.dmpFilesize
108KB
-
memory/3336-75-0x000000007FFF0000-0x000000007FFF7000-memory.dmpFilesize
28KB
-
memory/3336-76-0x000000007FFD0000-0x000000007FFD1000-memory.dmpFilesize
4KB