Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240419-en - resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system - submitted
01/05/2024, 06:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0b4ff0de3919a61ec83c4271f4c2c56f_JaffaCakes118.exe
Resource
win7-20231129-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
0b4ff0de3919a61ec83c4271f4c2c56f_JaffaCakes118.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 0b4ff0de3919a61ec83c4271f4c2c56f_JaffaCakes118.exe
- Size 462KB
- Sample240501-hmk7baac9v
- SHA256 6d3a0281e6c8f67b1bd9e51807b3acfcaa221d0cfbaee476117b1bf3b2c73c53
- MD5 0b4ff0de3919a61ec83c4271f4c2c56f
- SHA1 770b84628269c6c75ab4ab29ae1d337538b46289
- SHA512 d5c2fa8830ffabe23c1786805366a5c1961776cc47de849169455ae074ff8510ee56f29d4a93c87354ee362f2d68f346ed57bd2f3ff3f008816231966fbdc66f
- SSDEEP 12288:9crNS33L10QdrXP/X+tGfnbtAang35kGbXY0v7zd:ANA3R5drXPrfbCangpvXY0vl
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 4800 netsh.exe - Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation 0b4ff0de3919a61ec83c4271f4c2c56f_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation cfg.exe - Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1e6ec4cf0968997260bcdffd0c3b8f1a.exe Server.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1e6ec4cf0968997260bcdffd0c3b8f1a.exe Server.exe - Executes dropped EXE 2 IoCs
pid Process 3068 cfg.exe 3936 Server.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1e6ec4cf0968997260bcdffd0c3b8f1a = "\"C:\\Windows\\Server.exe\" .." Server.exe Set value (str) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1e6ec4cf0968997260bcdffd0c3b8f1a = "\"C:\\Windows\\Server.exe\" .." Server.exe - Drops file in Windows directory 10 IoCs
description ioc Process File created C:\Windows\Server.exe cfg.exe File opened for modification C:\Windows\Server.exe cfg.exe File created C:\Windows\__tmp_rar_sfx_access_check_240597890 0b4ff0de3919a61ec83c4271f4c2c56f_JaffaCakes118.exe File opened for modification C:\Windows\cfg.exe 0b4ff0de3919a61ec83c4271f4c2c56f_JaffaCakes118.exe File opened for modification C:\Windows\1.vbs 0b4ff0de3919a61ec83c4271f4c2c56f_JaffaCakes118.exe File created C:\Windows\__tmp_rar_sfx_access_check_240598406 cfg.exe File created C:\Windows\1.bat 0b4ff0de3919a61ec83c4271f4c2c56f_JaffaCakes118.exe File opened for modification C:\Windows\1.bat 0b4ff0de3919a61ec83c4271f4c2c56f_JaffaCakes118.exe File created C:\Windows\cfg.exe 0b4ff0de3919a61ec83c4271f4c2c56f_JaffaCakes118.exe File created C:\Windows\1.vbs 0b4ff0de3919a61ec83c4271f4c2c56f_JaffaCakes118.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings 0b4ff0de3919a61ec83c4271f4c2c56f_JaffaCakes118.exe - Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: SeDebugPrivilege 3936 Server.exe Token: 33 3936 Server.exe Token: SeIncBasePriorityPrivilege 3936 Server.exe Token: 33 3936 Server.exe Token: SeIncBasePriorityPrivilege 3936 Server.exe Token: 33 3936 Server.exe Token: SeIncBasePriorityPrivilege 3936 Server.exe Token: 33 3936 Server.exe Token: SeIncBasePriorityPrivilege 3936 Server.exe Token: 33 3936 Server.exe Token: SeIncBasePriorityPrivilege 3936 Server.exe Token: 33 3936 Server.exe Token: SeIncBasePriorityPrivilege 3936 Server.exe Token: 33 3936 Server.exe Token: SeIncBasePriorityPrivilege 3936 Server.exe Token: 33 3936 Server.exe Token: SeIncBasePriorityPrivilege 3936 Server.exe Token: 33 3936 Server.exe Token: SeIncBasePriorityPrivilege 3936 Server.exe Token: 33 3936 Server.exe Token: SeIncBasePriorityPrivilege 3936 Server.exe Token: 33 3936 Server.exe Token: SeIncBasePriorityPrivilege 3936 Server.exe Token: 33 3936 Server.exe Token: SeIncBasePriorityPrivilege 3936 Server.exe Token: 33 3936 Server.exe Token: SeIncBasePriorityPrivilege 3936 Server.exe Token: 33 3936 Server.exe Token: SeIncBasePriorityPrivilege 3936 Server.exe Token: 33 3936 Server.exe Token: SeIncBasePriorityPrivilege 3936 Server.exe Token: 33 3936 Server.exe Token: SeIncBasePriorityPrivilege 3936 Server.exe Token: 33 3936 Server.exe Token: SeIncBasePriorityPrivilege 3936 Server.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2896 wrote to memory of 228 2896 0b4ff0de3919a61ec83c4271f4c2c56f_JaffaCakes118.exe 85 PID 2896 wrote to memory of 228 2896 0b4ff0de3919a61ec83c4271f4c2c56f_JaffaCakes118.exe 85 PID 2896 wrote to memory of 228 2896 0b4ff0de3919a61ec83c4271f4c2c56f_JaffaCakes118.exe 85 PID 228 wrote to memory of 1512 228 WScript.exe 86 PID 228 wrote to memory of 1512 228 WScript.exe 86 PID 228 wrote to memory of 1512 228 WScript.exe 86 PID 1512 wrote to memory of 3068 1512 cmd.exe 88 PID 1512 wrote to memory of 3068 1512 cmd.exe 88 PID 1512 wrote to memory of 3068 1512 cmd.exe 88 PID 3068 wrote to memory of 3936 3068 cfg.exe 90 PID 3068 wrote to memory of 3936 3068 cfg.exe 90 PID 3068 wrote to memory of 3936 3068 cfg.exe 90 PID 3936 wrote to memory of 4800 3936 Server.exe 100 PID 3936 wrote to memory of 4800 3936 Server.exe 100 PID 3936 wrote to memory of 4800 3936 Server.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b4ff0de3919a61ec83c4271f4c2c56f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0b4ff0de3919a61ec83c4271f4c2c56f_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Windows\1.vbs"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:228 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c 1.bat3⤵
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Windows\cfg.execfg.exe -p12345 -dC:\Windows4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Windows\Server.exe"C:\Windows\Server.exe"5⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Windows\Server.exe" "Server.exe" ENABLE6⤵
- Modifies Windows Firewall
PID:4800
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\1.bat
- Size 39B
- SHA256 266922671b0c9a561236fa7c8ea123cf55debf2cce75a18bb5c502fd37c8bd65
- MD5 1526788b1c62379dacd4f7e704ec0e70
- SHA1 4ff138cf8c3d2d125472c0f933038492970e25ed
- SHA512 20a816853aa03b1777f9e1ffa8ddb4a3c80174da1bdbe5d15bc5205f22c7115b1f3509566f7347b8930d3b5333f1d603bd93c71ee4eff92980b7ddf49f775a91
- MD5 SHA1 SHA512
- Path C:\Windows\1.vbs
- Size 88B
- SHA256 4f6bbae207107ce573e92b43ee4418639a6fd38c9e46e8ed86f26c7269e52db7
- MD5 c2732a59f1bf8970cc06455c778cf786
- SHA1 dcaa247036a3c9d928f96574184beca1d32c81e8
- SHA512 1663066ce5a82b8c1f3c4b4825c1965c14501fd7ec3e15eea2108f2f15103186e2dce05a8de909d964666dcc8ebad592d50b47391ca76aedc6c678d0641579c5
- MD5 SHA1 SHA512
- Path C:\Windows\Server.exe
- Size 23KB
- SHA256 383fe311fa8f160bd538daf21b58ad879cee86fec2face9cd374f9cb739e421d
- MD5 3db696030d25a133d68be63e96ecba49
- SHA1 be695011ce4d1aaf4fab366684639f3f9022a551
- SHA512 d1cb73ab54c8c3c77105adb8f3a7c460a5582a75324c3c2382932ac2ef3aa6e1d5bc14303dd43a8ee48aadbcdca51b7e29f22c7e8ddb168ccb27cd46954a27dc
- SSDEEP 384:fpsqS+ER6vRKXGYKRWVSujUtX9w6Dglo61Z5DVmRvR6JZlbw8hqIusZzZYM:fif65K2Yf1jKRpcnu6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\cfg.exe
- Size 304KB
- SHA256 845620cbc4ebd9d00678e8860cc618a9d3b266b8c94fa6494caed0ec4e310f4b
- MD5 62519e87c5b1c39b0d2149709a2069a9
- SHA1 282c73ae9cb88280822c40bd6e58d4d7c1118c36
- SHA512 409d4b8fc50f00da857f7bcc81f90015a11e64c51ae6d079185076ac784284d1ac8d3c144aa07ae855afb7f9248f52947e7574bee2d439f610e1381340586421
- SSDEEP 6144:zIIcrXQ4S33w614mazUBHfSdocWYD24O/X+tGfni:9crNS33L10QdrXP/X+tGfni
- MD5 SHA1 SHA512 SSDEEP