Analysis
-
max time kernel
138s -
max time network
107s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
07-05-2024 06:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1fc41c7afda7b69a74ef89e3f6f0f2a6_JaffaCakes118.exe
Resource
win7-20231129-en
6 signatures
150 seconds
General
-
Target
1fc41c7afda7b69a74ef89e3f6f0f2a6_JaffaCakes118.exe
-
Size
317KB
-
MD5
1fc41c7afda7b69a74ef89e3f6f0f2a6
-
SHA1
43bc8cd4a3f6d6e05dc0d555607e4bef1f7cc7f5
-
SHA256
5847b4b9dfde0cbd35a1dbd452c409f542c38378b6452ac9e96c92e6821dcf41
-
SHA512
c6a9ef0a4f54461606ac51f7a897edb4948708d805123d1583635b80a205c2a3d2a3325ffbfbeaf79edede535828cc40dfdd4c8699cfa9873e6dde15a8a70354
-
SSDEEP
6144:ndL2kqeeb9756nqtQdFiGOw6NpA+UlXP7or/ULCnMnk3bpZhSu:ndKkqbZV6rEGz6NxwP6/VEk1bd
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation 1fc41c7afda7b69a74ef89e3f6f0f2a6_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
pid Process 5036 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 5036 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 884 wrote to memory of 1652 884 1fc41c7afda7b69a74ef89e3f6f0f2a6_JaffaCakes118.exe 85 PID 884 wrote to memory of 1652 884 1fc41c7afda7b69a74ef89e3f6f0f2a6_JaffaCakes118.exe 85 PID 884 wrote to memory of 1652 884 1fc41c7afda7b69a74ef89e3f6f0f2a6_JaffaCakes118.exe 85 PID 1652 wrote to memory of 5036 1652 cmd.exe 87 PID 1652 wrote to memory of 5036 1652 cmd.exe 87 PID 1652 wrote to memory of 5036 1652 cmd.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\1fc41c7afda7b69a74ef89e3f6f0f2a6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1fc41c7afda7b69a74ef89e3f6f0f2a6_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "1fc41c7afda7b69a74ef89e3f6f0f2a6_JaffaCakes118.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\1fc41c7afda7b69a74ef89e3f6f0f2a6_JaffaCakes118.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "1fc41c7afda7b69a74ef89e3f6f0f2a6_JaffaCakes118.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5036
-
-