Analysis
-
max time kernel
150s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
05-05-2024 16:49
Static task
static1
Behavioral task
behavioral1
Sample
18882465f8b6e72a46669d4aa2e78cb1_JaffaCakes118.exe
Resource
win7-20231129-en
General
-
Target
18882465f8b6e72a46669d4aa2e78cb1_JaffaCakes118.exe
-
Size
424KB
-
MD5
18882465f8b6e72a46669d4aa2e78cb1
-
SHA1
b05a070b6c3fec5330d1413594a4b17b19099a02
-
SHA256
6e521645df736e76b57cdf6996cee4a5148e649cee75be8f36ccfb008f047fa6
-
SHA512
388e34cfc7a43a062e0c389611036b7953a99d4def7699852d875c2fcdc7c6a79205d85fa128aae9d48d9c37888d60611390640086a7e7a3e4b0e38173964e44
-
SSDEEP
6144:6N9JYSDAzaiTCXkJNlMgpV5Nj3QmlsPt5GM/x1lPWojLWYM+6LpfeR14Kn3r/u/t:67RAzTukj/Nj5OlzW3ppWbhn3TcWId
Malware Config
Extracted
formbook
3.8
h308
sewrelax.com
southbaycurling.rocks
hongju101.com
nikkismithonline.com
bluprl.net
slursthisshark.com
smootord.com
buyoregonhemp.com
stepstolight.com
mchausverwalter.com
cofidis.cloud
queenartjewellery.com
samoedrasalvageengineers.com
skull.ltd
leapmotors.net
gayo.ltd
philborremans.com
yeezywaverunner700.com
febriananas.com
railor-music.com
jinlinw.com
alkqm.com
budgetao.com
284fkm.info
rale45pasleh.site
globalenergymanager.energy
81kam.com
minervastoybox.com
sainikschooldays.com
twincitieslegalcenter.info
bdj.ink
angelvc.top
darwym.com
angangnin.com
katharinerose.com
boshicn.net
unbehgenadvisors.net
xn--4kq.ink
higherheightsgenetics.com
freepandeiro.com
nymphcup.com
lukehensem.com
ast-35-ik0s-co2w.com
thinnerband.com
nutrigenomics.us
policesources.com
chinaqinyuan.com
greatgiftshopping.com
goodlandgrooming.com
genuinetech.store
monikaskrepes.com
drwang.group
breathtakingbusiness.com
favoritetraffic4updates.date
josephandkatherine.com
nemerla.reisen
meganlwilliams.com
ouclic.com
cunthogan.com
2makeyourday.life
c3iconsult.com
tnapp.info
athenseconomic.com
nlnldfr.info
plodameg.com
Signatures
-
Formbook payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\bin.exe formbook behavioral2/memory/3556-41-0x0000000000820000-0x000000000084A000-memory.dmp formbook -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
18882465f8b6e72a46669d4aa2e78cb1_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation 18882465f8b6e72a46669d4aa2e78cb1_JaffaCakes118.exe -
Executes dropped EXE 3 IoCs
Processes:
bin.exeskypeeApp.exeskypeeApp.exepid process 1360 bin.exe 3396 skypeeApp.exe 3556 skypeeApp.exe -
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral2/memory/4720-6-0x0000000004D30000-0x0000000004D44000-memory.dmp agile_net -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
skypeeApp.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\skypeeApplication = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\skypeeApp.exe -boot" skypeeApp.exe -
Suspicious use of SetThreadContext 5 IoCs
Processes:
bin.exemsdt.exeskypeeApp.exedescription pid process target process PID 1360 set thread context of 3600 1360 bin.exe Explorer.EXE PID 5092 set thread context of 3600 5092 msdt.exe Explorer.EXE PID 5092 set thread context of 3100 5092 msdt.exe explorer.exe PID 5092 set thread context of 4016 5092 msdt.exe explorer.exe PID 3396 set thread context of 3556 3396 skypeeApp.exe skypeeApp.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4276 3556 WerFault.exe skypeeApp.exe -
Suspicious behavior: EnumeratesProcesses 56 IoCs
Processes:
bin.exemsdt.exepid process 1360 bin.exe 1360 bin.exe 1360 bin.exe 1360 bin.exe 5092 msdt.exe 5092 msdt.exe 5092 msdt.exe 5092 msdt.exe 5092 msdt.exe 5092 msdt.exe 5092 msdt.exe 5092 msdt.exe 5092 msdt.exe 5092 msdt.exe 5092 msdt.exe 5092 msdt.exe 5092 msdt.exe 5092 msdt.exe 5092 msdt.exe 5092 msdt.exe 5092 msdt.exe 5092 msdt.exe 5092 msdt.exe 5092 msdt.exe 5092 msdt.exe 5092 msdt.exe 5092 msdt.exe 5092 msdt.exe 5092 msdt.exe 5092 msdt.exe 5092 msdt.exe 5092 msdt.exe 5092 msdt.exe 5092 msdt.exe 5092 msdt.exe 5092 msdt.exe 5092 msdt.exe 5092 msdt.exe 5092 msdt.exe 5092 msdt.exe 5092 msdt.exe 5092 msdt.exe 5092 msdt.exe 5092 msdt.exe 5092 msdt.exe 5092 msdt.exe 5092 msdt.exe 5092 msdt.exe 5092 msdt.exe 5092 msdt.exe 5092 msdt.exe 5092 msdt.exe 5092 msdt.exe 5092 msdt.exe 5092 msdt.exe 5092 msdt.exe -
Suspicious behavior: MapViewOfSection 9 IoCs
Processes:
bin.exemsdt.exepid process 1360 bin.exe 1360 bin.exe 1360 bin.exe 5092 msdt.exe 5092 msdt.exe 5092 msdt.exe 5092 msdt.exe 5092 msdt.exe 5092 msdt.exe -
Suspicious use of AdjustPrivilegeToken 28 IoCs
Processes:
18882465f8b6e72a46669d4aa2e78cb1_JaffaCakes118.exebin.exemsdt.exeExplorer.EXEskypeeApp.exedescription pid process Token: SeDebugPrivilege 4720 18882465f8b6e72a46669d4aa2e78cb1_JaffaCakes118.exe Token: SeDebugPrivilege 1360 bin.exe Token: SeDebugPrivilege 5092 msdt.exe Token: SeShutdownPrivilege 3600 Explorer.EXE Token: SeCreatePagefilePrivilege 3600 Explorer.EXE Token: SeDebugPrivilege 3396 skypeeApp.exe Token: SeShutdownPrivilege 3600 Explorer.EXE Token: SeCreatePagefilePrivilege 3600 Explorer.EXE Token: SeShutdownPrivilege 3600 Explorer.EXE Token: SeCreatePagefilePrivilege 3600 Explorer.EXE Token: SeShutdownPrivilege 3600 Explorer.EXE Token: SeCreatePagefilePrivilege 3600 Explorer.EXE Token: SeShutdownPrivilege 3600 Explorer.EXE Token: SeCreatePagefilePrivilege 3600 Explorer.EXE Token: SeShutdownPrivilege 3600 Explorer.EXE Token: SeCreatePagefilePrivilege 3600 Explorer.EXE Token: SeShutdownPrivilege 3600 Explorer.EXE Token: SeCreatePagefilePrivilege 3600 Explorer.EXE Token: SeShutdownPrivilege 3600 Explorer.EXE Token: SeCreatePagefilePrivilege 3600 Explorer.EXE Token: SeShutdownPrivilege 3600 Explorer.EXE Token: SeCreatePagefilePrivilege 3600 Explorer.EXE Token: SeShutdownPrivilege 3600 Explorer.EXE Token: SeCreatePagefilePrivilege 3600 Explorer.EXE Token: SeShutdownPrivilege 3600 Explorer.EXE Token: SeCreatePagefilePrivilege 3600 Explorer.EXE Token: SeShutdownPrivilege 3600 Explorer.EXE Token: SeCreatePagefilePrivilege 3600 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3600 Explorer.EXE -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
18882465f8b6e72a46669d4aa2e78cb1_JaffaCakes118.exeexplorer.exeExplorer.EXEmsdt.exeexplorer.exeskypeeApp.exedescription pid process target process PID 4720 wrote to memory of 2372 4720 18882465f8b6e72a46669d4aa2e78cb1_JaffaCakes118.exe explorer.exe PID 4720 wrote to memory of 2372 4720 18882465f8b6e72a46669d4aa2e78cb1_JaffaCakes118.exe explorer.exe PID 4720 wrote to memory of 2372 4720 18882465f8b6e72a46669d4aa2e78cb1_JaffaCakes118.exe explorer.exe PID 3100 wrote to memory of 1360 3100 explorer.exe bin.exe PID 3100 wrote to memory of 1360 3100 explorer.exe bin.exe PID 3100 wrote to memory of 1360 3100 explorer.exe bin.exe PID 3600 wrote to memory of 5092 3600 Explorer.EXE msdt.exe PID 3600 wrote to memory of 5092 3600 Explorer.EXE msdt.exe PID 3600 wrote to memory of 5092 3600 Explorer.EXE msdt.exe PID 5092 wrote to memory of 2628 5092 msdt.exe cmd.exe PID 5092 wrote to memory of 2628 5092 msdt.exe cmd.exe PID 5092 wrote to memory of 2628 5092 msdt.exe cmd.exe PID 4720 wrote to memory of 3952 4720 18882465f8b6e72a46669d4aa2e78cb1_JaffaCakes118.exe cmd.exe PID 4720 wrote to memory of 3952 4720 18882465f8b6e72a46669d4aa2e78cb1_JaffaCakes118.exe cmd.exe PID 4720 wrote to memory of 3952 4720 18882465f8b6e72a46669d4aa2e78cb1_JaffaCakes118.exe cmd.exe PID 4720 wrote to memory of 4868 4720 18882465f8b6e72a46669d4aa2e78cb1_JaffaCakes118.exe explorer.exe PID 4720 wrote to memory of 4868 4720 18882465f8b6e72a46669d4aa2e78cb1_JaffaCakes118.exe explorer.exe PID 4720 wrote to memory of 4868 4720 18882465f8b6e72a46669d4aa2e78cb1_JaffaCakes118.exe explorer.exe PID 4016 wrote to memory of 3396 4016 explorer.exe skypeeApp.exe PID 4016 wrote to memory of 3396 4016 explorer.exe skypeeApp.exe PID 4016 wrote to memory of 3396 4016 explorer.exe skypeeApp.exe PID 3396 wrote to memory of 3556 3396 skypeeApp.exe skypeeApp.exe PID 3396 wrote to memory of 3556 3396 skypeeApp.exe skypeeApp.exe PID 3396 wrote to memory of 3556 3396 skypeeApp.exe skypeeApp.exe PID 3396 wrote to memory of 3556 3396 skypeeApp.exe skypeeApp.exe PID 3396 wrote to memory of 3556 3396 skypeeApp.exe skypeeApp.exe PID 3396 wrote to memory of 3556 3396 skypeeApp.exe skypeeApp.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\18882465f8b6e72a46669d4aa2e78cb1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\18882465f8b6e72a46669d4aa2e78cb1_JaffaCakes118.exe"2⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\System32\explorer.exe" /c, "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\bin.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\18882465f8b6e72a46669d4aa2e78cb1_JaffaCakes118.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\skypeeApp.exe"3⤵
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\System32\explorer.exe" /c, "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\skypeeApp.exe"3⤵
-
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\bin.exe"3⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\bin.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\bin.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\skypeeApp.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\skypeeApp.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\skypeeApp.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\skypeeApp.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3556 -s 2204⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3556 -ip 35561⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\bin.exeFilesize
167KB
MD504ff1d14354721ffe522ca7484e4511a
SHA1c3034af51fe4f44a40eaff41e10fd041f280fe67
SHA25691d1633f58df12c46b45d091d4dda9ce71006d84383ec0ee63f2e39072bdfea2
SHA5125954c30a19657128fc73963423421f5365dacfa8d89264a2ac69f6f04fa5e0ea42d458ee0aaf0257cef774a4c2ba3208d35e5193f1103010716f77710d9123ab
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\skypeeApp.exeFilesize
424KB
MD518882465f8b6e72a46669d4aa2e78cb1
SHA1b05a070b6c3fec5330d1413594a4b17b19099a02
SHA2566e521645df736e76b57cdf6996cee4a5148e649cee75be8f36ccfb008f047fa6
SHA512388e34cfc7a43a062e0c389611036b7953a99d4def7699852d875c2fcdc7c6a79205d85fa128aae9d48d9c37888d60611390640086a7e7a3e4b0e38173964e44
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\bin.txtFilesize
32B
MD5f163396219e4df6dfc3c59d9f82b96fc
SHA15d7c990bc1fe606dd14ebb63e07c0ab576ae6932
SHA2561b017689009780e08d9cbe2b75f050c7b0972b6dbab3f0fb3b1a5a7f17556e48
SHA5123361cd1172e6127fa160d8aecc107e5e8c5c28b06384d56c5c4b154888132b214aa1d10f280bd03fc3e44e3c6475306c46e2b1db3dc18ba913dc997af80e0f9a
-
memory/3100-33-0x0000000003B40000-0x0000000003C77000-memory.dmpFilesize
1.2MB
-
memory/3100-22-0x0000000003B40000-0x0000000003C77000-memory.dmpFilesize
1.2MB
-
memory/3556-41-0x0000000000820000-0x000000000084A000-memory.dmpFilesize
168KB
-
memory/3600-20-0x0000000008AD0000-0x0000000008BDF000-memory.dmpFilesize
1.1MB
-
memory/4016-43-0x0000000003470000-0x00000000035E1000-memory.dmpFilesize
1.4MB
-
memory/4016-37-0x0000000003470000-0x00000000035E1000-memory.dmpFilesize
1.4MB
-
memory/4720-15-0x000000007520E000-0x000000007520F000-memory.dmpFilesize
4KB
-
memory/4720-0-0x000000007520E000-0x000000007520F000-memory.dmpFilesize
4KB
-
memory/4720-16-0x0000000075200000-0x00000000759B0000-memory.dmpFilesize
7.7MB
-
memory/4720-7-0x0000000004DF0000-0x0000000004E8C000-memory.dmpFilesize
624KB
-
memory/4720-6-0x0000000004D30000-0x0000000004D44000-memory.dmpFilesize
80KB
-
memory/4720-28-0x0000000075200000-0x00000000759B0000-memory.dmpFilesize
7.7MB
-
memory/4720-5-0x0000000075200000-0x00000000759B0000-memory.dmpFilesize
7.7MB
-
memory/4720-4-0x0000000004AC0000-0x0000000004ACA000-memory.dmpFilesize
40KB
-
memory/4720-3-0x0000000004B50000-0x0000000004BE2000-memory.dmpFilesize
584KB
-
memory/4720-2-0x0000000005060000-0x0000000005604000-memory.dmpFilesize
5.6MB
-
memory/4720-1-0x0000000000090000-0x0000000000100000-memory.dmpFilesize
448KB
-
memory/5092-13-0x0000000000850000-0x00000000008A7000-memory.dmpFilesize
348KB