Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
09-05-2024 18:02
Static task
static1
Behavioral task
behavioral1
Sample
2b339850ba96bb3c8308c70acd7ac521_JaffaCakes118.exe
Resource
win7-20240215-en
General
-
Target
2b339850ba96bb3c8308c70acd7ac521_JaffaCakes118.exe
-
Size
458KB
-
MD5
2b339850ba96bb3c8308c70acd7ac521
-
SHA1
4c497319129abac43989a7a75c4ff8d3fee9554e
-
SHA256
2040586dd9fea01ac08b13748962e9c7ec2bebd618d92543f260984b2eebc352
-
SHA512
bba4a5d960e100295b7e2c33edfbc2e922ca12a92d43a7ec122f4d2dec33579abd38e4ef69134ed8e35bbbb8cc83efcaf7e67f1f5f2dfa6fc4c54bcd29eea401
-
SSDEEP
12288:OSLFxvaN9Se5U17u1KFHeSJ7zdGUvVbCY:rFI9UqKNeSJ7zdGUB
Malware Config
Extracted
formbook
3.9
vi
thehealingcentersintl.com
moiuc.com
foundationtsecuritysn.win
dmorganconstruction.com
rcyg-luxgen.com
xn--9iqxb19lb98e.com
method19baseball.com
caitlinsculpts.com
xn--tpqt61am2s90v.com
clu2007.com
avto-4x4.com
newcode315.com
earnshort.com
instamanga.click
entruempelungs.taxi
brownpaperitckets.com
prepster-inc.com
espacoredator.com
pacificartspublishing.com
ekohelper.net
nascenceconsultant.com
gibussigynpamsplendids.link
opebet650.com
catlf.com
tarro.net
justfashionpassion.info
izmitsove.net
gojmi.com
duckieland.com
yukesw.com
templesofsatan.com
grindgrapple.com
elityapiemlak.net
whippedlardo.com
eatsmartcookie.com
equipment-spoil.com
490ope.com
prefixed.info
50020xatf.com
igreda.com
silversailtourism.biz
xux-sh.com
karafilico.com
cng-euroqe.com
mimo136.com
rushmorerunner.net
pbbwchr5w589dbv5.biz
youngqueensbyally.com
guaranteeopqq.site
eternalpelican.win
i501.info
smartpersuasion.net
nomasfilasapp.com
virtual-flix.world
happydayholidays.com
corevids.net
peterohanyan.com
songathome.com
sijiatingyuan.com
indahashcoin.com
hizmetasistanim.info
kn4frp.com
captivatingcreations.design
freddys-bikershop.com
dronlac.com
Signatures
-
Formbook payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4516-15-0x0000000000400000-0x000000000042A000-memory.dmp formbook behavioral2/memory/4516-20-0x00000000015B0000-0x00000000018FA000-memory.dmp formbook -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
2b339850ba96bb3c8308c70acd7ac521_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation 2b339850ba96bb3c8308c70acd7ac521_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
Processes:
2b339850ba96bb3c8308c70acd7ac521_JaffaCakes118.exepid process 4516 2b339850ba96bb3c8308c70acd7ac521_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
2b339850ba96bb3c8308c70acd7ac521_JaffaCakes118.exedescription pid process target process PID 744 set thread context of 4516 744 2b339850ba96bb3c8308c70acd7ac521_JaffaCakes118.exe 2b339850ba96bb3c8308c70acd7ac521_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NTFS ADS 2 IoCs
Processes:
cmd.execmd.exedescription ioc process File created C:\Users\Admin\AppData\Local\Temp\2b339850ba96bb3c8308c70acd7ac521_JaffaCakes118.exe:Zone.Identifier cmd.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\2b339850ba96bb3c8308c70acd7ac521_JaffaCakes118.exe:Zone.Identifier cmd.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
2b339850ba96bb3c8308c70acd7ac521_JaffaCakes118.exepid process 4516 2b339850ba96bb3c8308c70acd7ac521_JaffaCakes118.exe 4516 2b339850ba96bb3c8308c70acd7ac521_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
2b339850ba96bb3c8308c70acd7ac521_JaffaCakes118.exedescription pid process Token: SeDebugPrivilege 744 2b339850ba96bb3c8308c70acd7ac521_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
2b339850ba96bb3c8308c70acd7ac521_JaffaCakes118.exedescription pid process target process PID 744 wrote to memory of 3544 744 2b339850ba96bb3c8308c70acd7ac521_JaffaCakes118.exe cmd.exe PID 744 wrote to memory of 3544 744 2b339850ba96bb3c8308c70acd7ac521_JaffaCakes118.exe cmd.exe PID 744 wrote to memory of 3544 744 2b339850ba96bb3c8308c70acd7ac521_JaffaCakes118.exe cmd.exe PID 744 wrote to memory of 2560 744 2b339850ba96bb3c8308c70acd7ac521_JaffaCakes118.exe cmd.exe PID 744 wrote to memory of 2560 744 2b339850ba96bb3c8308c70acd7ac521_JaffaCakes118.exe cmd.exe PID 744 wrote to memory of 2560 744 2b339850ba96bb3c8308c70acd7ac521_JaffaCakes118.exe cmd.exe PID 744 wrote to memory of 4516 744 2b339850ba96bb3c8308c70acd7ac521_JaffaCakes118.exe 2b339850ba96bb3c8308c70acd7ac521_JaffaCakes118.exe PID 744 wrote to memory of 4516 744 2b339850ba96bb3c8308c70acd7ac521_JaffaCakes118.exe 2b339850ba96bb3c8308c70acd7ac521_JaffaCakes118.exe PID 744 wrote to memory of 4516 744 2b339850ba96bb3c8308c70acd7ac521_JaffaCakes118.exe 2b339850ba96bb3c8308c70acd7ac521_JaffaCakes118.exe PID 744 wrote to memory of 4516 744 2b339850ba96bb3c8308c70acd7ac521_JaffaCakes118.exe 2b339850ba96bb3c8308c70acd7ac521_JaffaCakes118.exe PID 744 wrote to memory of 4516 744 2b339850ba96bb3c8308c70acd7ac521_JaffaCakes118.exe 2b339850ba96bb3c8308c70acd7ac521_JaffaCakes118.exe PID 744 wrote to memory of 4516 744 2b339850ba96bb3c8308c70acd7ac521_JaffaCakes118.exe 2b339850ba96bb3c8308c70acd7ac521_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b339850ba96bb3c8308c70acd7ac521_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2b339850ba96bb3c8308c70acd7ac521_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Local\Temp\2b339850ba96bb3c8308c70acd7ac521_JaffaCakes118.exe:Zone.Identifier"2⤵
- NTFS ADS
PID:3544 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Local\Temp\2b339850ba96bb3c8308c70acd7ac521_JaffaCakes118.exe:Zone.Identifier"2⤵
- NTFS ADS
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\2b339850ba96bb3c8308c70acd7ac521_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2b339850ba96bb3c8308c70acd7ac521_JaffaCakes118.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4516
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
458KB
MD52b339850ba96bb3c8308c70acd7ac521
SHA14c497319129abac43989a7a75c4ff8d3fee9554e
SHA2562040586dd9fea01ac08b13748962e9c7ec2bebd618d92543f260984b2eebc352
SHA512bba4a5d960e100295b7e2c33edfbc2e922ca12a92d43a7ec122f4d2dec33579abd38e4ef69134ed8e35bbbb8cc83efcaf7e67f1f5f2dfa6fc4c54bcd29eea401