Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
05-05-2024 02:22
Static task
static1
Behavioral task
behavioral1
Sample
158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe
Resource
win7-20240220-en
General
-
Target
158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe
-
Size
893KB
-
MD5
158c84cc65140c2ee6327ad82e294af3
-
SHA1
2cdc05e4d6c0f2beca3ecc0ab3b45b66896538b2
-
SHA256
4ac320020cc130f74bed1a16e367fa883fb19be2ed742995448ad0edc2e2c952
-
SHA512
845cec3bb37fe9e3b38e7048ef2cd6294c095d244bf71b8b367c1aa4ffa4cf1804c38dea1cd33e263401e0c0e31d8583e3d36b25c974a66fc1a0b4efafb0a243
-
SSDEEP
12288:agDdArMrjqK1XXRoRk+9FUn+HGRkhumTQXYPcOvXR:agJAIn7xXR1+QkhuG53vXR
Malware Config
Signatures
-
Detect ZGRat V1 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3700-4-0x00000000057B0000-0x00000000057E8000-memory.dmp family_zgrat_v1 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe -
Executes dropped EXE 2 IoCs
Processes:
158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exepid process 5104 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe 4468 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe -
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral2/memory/3700-4-0x00000000057B0000-0x00000000057E8000-memory.dmp agile_net -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Fintess = "C:\\Users\\Admin\\AppData\\Roaming\\Fitnees\\Calme.exe" 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Fintess = "\\Fitnees\\Calme.exe" 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exedescription pid process target process PID 3700 set thread context of 1548 3700 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe PID 5104 set thread context of 4468 5104 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 48 IoCs
Processes:
158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exepid process 1548 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe 1548 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe 1548 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe 1548 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe 1548 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe 1548 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe 1548 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe 1548 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe 1548 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe 1548 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe 1548 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe 1548 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe 1548 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe 1548 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe 1548 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe 1548 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe 1548 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe 1548 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe 1548 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe 1548 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe 1548 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe 1548 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe 1548 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe 1548 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe 1548 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe 4468 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe 4468 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe 4468 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe 4468 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe 4468 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe 4468 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe 4468 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe 4468 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe 4468 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe 4468 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe 4468 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe 4468 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe 4468 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe 4468 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe 4468 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe 4468 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe 4468 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe 4468 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe 4468 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe 4468 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe 4468 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe 4468 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe 4468 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exepid process 4468 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exedescription pid process Token: SeDebugPrivilege 3700 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe Token: SeDebugPrivilege 1548 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe Token: SeDebugPrivilege 5104 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe Token: SeDebugPrivilege 4468 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe Token: 33 4468 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe Token: SeIncBasePriorityPrivilege 4468 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exepid process 4468 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.execmd.exe158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exedescription pid process target process PID 3700 wrote to memory of 1548 3700 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe PID 3700 wrote to memory of 1548 3700 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe PID 3700 wrote to memory of 1548 3700 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe PID 3700 wrote to memory of 1548 3700 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe PID 3700 wrote to memory of 1548 3700 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe PID 3700 wrote to memory of 1548 3700 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe PID 3700 wrote to memory of 1548 3700 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe PID 3700 wrote to memory of 1548 3700 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe PID 1548 wrote to memory of 5104 1548 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe PID 1548 wrote to memory of 5104 1548 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe PID 1548 wrote to memory of 5104 1548 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe PID 1548 wrote to memory of 1168 1548 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe cmd.exe PID 1548 wrote to memory of 1168 1548 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe cmd.exe PID 1548 wrote to memory of 1168 1548 158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe cmd.exe PID 1168 wrote to memory of 4872 1168 cmd.exe PING.EXE PID 1168 wrote to memory of 4872 1168 cmd.exe PING.EXE PID 1168 wrote to memory of 4872 1168 cmd.exe PING.EXE PID 5104 wrote to memory of 4468 5104 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe PID 5104 wrote to memory of 4468 5104 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe PID 5104 wrote to memory of 4468 5104 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe PID 5104 wrote to memory of 4468 5104 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe PID 5104 wrote to memory of 4468 5104 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe PID 5104 wrote to memory of 4468 5104 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe PID 5104 wrote to memory of 4468 5104 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe PID 5104 wrote to memory of 4468 5104 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe 158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\158c84cc65140c2ee6327ad82e294af3_jaffacakes118\158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe"C:\Users\Admin\AppData\Local\Temp\158c84cc65140c2ee6327ad82e294af3_jaffacakes118\158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\158c84cc65140c2ee6327ad82e294af3_jaffacakes118\158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe"C:\Users\Admin\AppData\Local\Temp\158c84cc65140c2ee6327ad82e294af3_jaffacakes118\158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 1000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 10004⤵
- Runs ping.exe
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\158c84cc65140c2ee6327ad82e294af3_JaffaCakes118.exe.logFilesize
1KB
MD58ec831f3e3a3f77e4a7b9cd32b48384c
SHA1d83f09fd87c5bd86e045873c231c14836e76a05c
SHA2567667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
SHA51226bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3
-
C:\Users\Admin\AppData\Local\Temp\158c84cc65140c2ee6327ad82e294af3_jaffacakes118\158c84cc65140c2ee6327ad82e294af3_jaffacakes118.exeFilesize
893KB
MD5158c84cc65140c2ee6327ad82e294af3
SHA12cdc05e4d6c0f2beca3ecc0ab3b45b66896538b2
SHA2564ac320020cc130f74bed1a16e367fa883fb19be2ed742995448ad0edc2e2c952
SHA512845cec3bb37fe9e3b38e7048ef2cd6294c095d244bf71b8b367c1aa4ffa4cf1804c38dea1cd33e263401e0c0e31d8583e3d36b25c974a66fc1a0b4efafb0a243
-
C:\Users\Admin\AppData\Roaming\Imminent\Path.datFilesize
48B
MD5b770e04d567984960e551b9f0f66276b
SHA1304712aa2b82f84a393fc014bcdfafec55a2d923
SHA256c4e8f4af6a023b980cecdac61b5231060946b76dd053e4767cefabdb810afb9d
SHA512c601af9a4e05e9797fd2273d1a3e8618909b744e8fe8c12b5ceaabd2be19d12cfebf94abb93511fcf9ffbac9b217d894206b6e59f727bced09dffd0abffcd843
-
memory/1548-16-0x0000000000790000-0x00000000007E6000-memory.dmpFilesize
344KB
-
memory/1548-15-0x0000000074A80000-0x0000000075230000-memory.dmpFilesize
7.7MB
-
memory/1548-35-0x0000000074A80000-0x0000000075230000-memory.dmpFilesize
7.7MB
-
memory/1548-22-0x0000000007610000-0x0000000007628000-memory.dmpFilesize
96KB
-
memory/1548-21-0x00000000072A0000-0x0000000007306000-memory.dmpFilesize
408KB
-
memory/1548-20-0x0000000004C60000-0x0000000004C88000-memory.dmpFilesize
160KB
-
memory/1548-19-0x0000000004E00000-0x0000000004EAE000-memory.dmpFilesize
696KB
-
memory/1548-18-0x0000000074A80000-0x0000000075230000-memory.dmpFilesize
7.7MB
-
memory/1548-17-0x0000000004C00000-0x0000000004C10000-memory.dmpFilesize
64KB
-
memory/3700-10-0x0000000074A80000-0x0000000075230000-memory.dmpFilesize
7.7MB
-
memory/3700-2-0x0000000005CB0000-0x0000000006254000-memory.dmpFilesize
5.6MB
-
memory/3700-0-0x0000000074A8E000-0x0000000074A8F000-memory.dmpFilesize
4KB
-
memory/3700-14-0x0000000074A80000-0x0000000075230000-memory.dmpFilesize
7.7MB
-
memory/3700-4-0x00000000057B0000-0x00000000057E8000-memory.dmpFilesize
224KB
-
memory/3700-9-0x0000000074A8E000-0x0000000074A8F000-memory.dmpFilesize
4KB
-
memory/3700-8-0x0000000009430000-0x00000000094CC000-memory.dmpFilesize
624KB
-
memory/3700-7-0x0000000074A80000-0x0000000075230000-memory.dmpFilesize
7.7MB
-
memory/3700-6-0x0000000005230000-0x000000000523A000-memory.dmpFilesize
40KB
-
memory/3700-3-0x00000000057E0000-0x0000000005872000-memory.dmpFilesize
584KB
-
memory/3700-1-0x0000000000D20000-0x0000000000E04000-memory.dmpFilesize
912KB
-
memory/3700-5-0x00000000056D0000-0x00000000056D6000-memory.dmpFilesize
24KB
-
memory/4468-43-0x0000000007370000-0x0000000007386000-memory.dmpFilesize
88KB
-
memory/5104-36-0x0000000074A80000-0x0000000075230000-memory.dmpFilesize
7.7MB
-
memory/5104-37-0x0000000074A80000-0x0000000075230000-memory.dmpFilesize
7.7MB
-
memory/5104-40-0x0000000074A80000-0x0000000075230000-memory.dmpFilesize
7.7MB
-
memory/5104-34-0x0000000074A80000-0x0000000075230000-memory.dmpFilesize
7.7MB