Analysis
-
max time kernel
149s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
11-05-2024 01:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
322597f76541eac0f3e380d1795fcdfa_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
322597f76541eac0f3e380d1795fcdfa_JaffaCakes118.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
16 signatures
150 seconds
General
-
Target
322597f76541eac0f3e380d1795fcdfa_JaffaCakes118.exe
-
Size
338KB
-
MD5
322597f76541eac0f3e380d1795fcdfa
-
SHA1
abfe0bc3dc130aba0089aef3e0589d1d79040cb6
-
SHA256
be168b4be501e534364a3a3430f379298d364801e484cf6cf54cd76e06a50872
-
SHA512
2c553a84615e3881aaadda40dcea10f66754e7df48e1ccafe4b1aab148d3d48c48e6898fddc523d92cc460d05d61392c837ff9e6583316d6fa16484c2eb10e18
-
SSDEEP
6144:BL02q/7C0iXsqjrnIehtfvK5Jn6JN4PNOYXrIDWyyYW96dB:B3MCx8qjrIaleJnS+N7XEWtYc6D
Score
10/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 322597f76541eac0f3e380d1795fcdfa_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 322597f76541eac0f3e380d1795fcdfa_jaffacakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 1668 322597f76541eac0f3e380d1795fcdfa_jaffacakes118.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows = "\\Explorer\\Windows-Explorer.exe" 322597f76541eac0f3e380d1795fcdfa_jaffacakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows = "C:\\Users\\Admin\\AppData\\Roaming\\Explorer\\Windows-Explorer.exe" 322597f76541eac0f3e380d1795fcdfa_jaffacakes118.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created C:\Windows\assembly\Desktop.ini 322597f76541eac0f3e380d1795fcdfa_jaffacakes118.exe File opened for modification C:\Windows\assembly\Desktop.ini 322597f76541eac0f3e380d1795fcdfa_jaffacakes118.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\assembly 322597f76541eac0f3e380d1795fcdfa_jaffacakes118.exe File created C:\Windows\assembly\Desktop.ini 322597f76541eac0f3e380d1795fcdfa_jaffacakes118.exe File opened for modification C:\Windows\assembly\Desktop.ini 322597f76541eac0f3e380d1795fcdfa_jaffacakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 Taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A Taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName Taskmgr.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 4688 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1668 322597f76541eac0f3e380d1795fcdfa_jaffacakes118.exe 1668 322597f76541eac0f3e380d1795fcdfa_jaffacakes118.exe 1668 322597f76541eac0f3e380d1795fcdfa_jaffacakes118.exe 1668 322597f76541eac0f3e380d1795fcdfa_jaffacakes118.exe 1668 322597f76541eac0f3e380d1795fcdfa_jaffacakes118.exe 1668 322597f76541eac0f3e380d1795fcdfa_jaffacakes118.exe 1668 322597f76541eac0f3e380d1795fcdfa_jaffacakes118.exe 1668 322597f76541eac0f3e380d1795fcdfa_jaffacakes118.exe 1668 322597f76541eac0f3e380d1795fcdfa_jaffacakes118.exe 1668 322597f76541eac0f3e380d1795fcdfa_jaffacakes118.exe 1668 322597f76541eac0f3e380d1795fcdfa_jaffacakes118.exe 1668 322597f76541eac0f3e380d1795fcdfa_jaffacakes118.exe 1668 322597f76541eac0f3e380d1795fcdfa_jaffacakes118.exe 1668 322597f76541eac0f3e380d1795fcdfa_jaffacakes118.exe 1668 322597f76541eac0f3e380d1795fcdfa_jaffacakes118.exe 1668 322597f76541eac0f3e380d1795fcdfa_jaffacakes118.exe 1668 322597f76541eac0f3e380d1795fcdfa_jaffacakes118.exe 1668 322597f76541eac0f3e380d1795fcdfa_jaffacakes118.exe 1668 322597f76541eac0f3e380d1795fcdfa_jaffacakes118.exe 1668 322597f76541eac0f3e380d1795fcdfa_jaffacakes118.exe 1668 322597f76541eac0f3e380d1795fcdfa_jaffacakes118.exe 1668 322597f76541eac0f3e380d1795fcdfa_jaffacakes118.exe 1668 322597f76541eac0f3e380d1795fcdfa_jaffacakes118.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 1668 322597f76541eac0f3e380d1795fcdfa_jaffacakes118.exe 4544 Taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 3080 322597f76541eac0f3e380d1795fcdfa_JaffaCakes118.exe Token: SeDebugPrivilege 1668 322597f76541eac0f3e380d1795fcdfa_jaffacakes118.exe Token: 33 1668 322597f76541eac0f3e380d1795fcdfa_jaffacakes118.exe Token: SeIncBasePriorityPrivilege 1668 322597f76541eac0f3e380d1795fcdfa_jaffacakes118.exe Token: SeDebugPrivilege 4544 Taskmgr.exe Token: SeSystemProfilePrivilege 4544 Taskmgr.exe Token: SeCreateGlobalPrivilege 4544 Taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe 4544 Taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1668 322597f76541eac0f3e380d1795fcdfa_jaffacakes118.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3080 wrote to memory of 1668 3080 322597f76541eac0f3e380d1795fcdfa_JaffaCakes118.exe 84 PID 3080 wrote to memory of 1668 3080 322597f76541eac0f3e380d1795fcdfa_JaffaCakes118.exe 84 PID 3080 wrote to memory of 1668 3080 322597f76541eac0f3e380d1795fcdfa_JaffaCakes118.exe 84 PID 3080 wrote to memory of 1408 3080 322597f76541eac0f3e380d1795fcdfa_JaffaCakes118.exe 85 PID 3080 wrote to memory of 1408 3080 322597f76541eac0f3e380d1795fcdfa_JaffaCakes118.exe 85 PID 3080 wrote to memory of 1408 3080 322597f76541eac0f3e380d1795fcdfa_JaffaCakes118.exe 85 PID 1408 wrote to memory of 4688 1408 cmd.exe 87 PID 1408 wrote to memory of 4688 1408 cmd.exe 87 PID 1408 wrote to memory of 4688 1408 cmd.exe 87 PID 1668 wrote to memory of 4544 1668 322597f76541eac0f3e380d1795fcdfa_jaffacakes118.exe 90 PID 1668 wrote to memory of 4544 1668 322597f76541eac0f3e380d1795fcdfa_jaffacakes118.exe 90 PID 1668 wrote to memory of 4544 1668 322597f76541eac0f3e380d1795fcdfa_jaffacakes118.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\322597f76541eac0f3e380d1795fcdfa_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\322597f76541eac0f3e380d1795fcdfa_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\322597f76541eac0f3e380d1795fcdfa_jaffacakes118\322597f76541eac0f3e380d1795fcdfa_jaffacakes118.exe"C:\Users\Admin\AppData\Local\Temp\322597f76541eac0f3e380d1795fcdfa_jaffacakes118\322597f76541eac0f3e380d1795fcdfa_jaffacakes118.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Windows\SysWOW64\Taskmgr.exe"C:\Windows\System32\Taskmgr.exe"3⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4544
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 1000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\322597f76541eac0f3e380d1795fcdfa_JaffaCakes118.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 10003⤵
- Runs ping.exe
PID:4688
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\322597f76541eac0f3e380d1795fcdfa_jaffacakes118\322597f76541eac0f3e380d1795fcdfa_jaffacakes118.exe
Filesize338KB
MD5322597f76541eac0f3e380d1795fcdfa
SHA1abfe0bc3dc130aba0089aef3e0589d1d79040cb6
SHA256be168b4be501e534364a3a3430f379298d364801e484cf6cf54cd76e06a50872
SHA5122c553a84615e3881aaadda40dcea10f66754e7df48e1ccafe4b1aab148d3d48c48e6898fddc523d92cc460d05d61392c837ff9e6583316d6fa16484c2eb10e18
-
Filesize
60B
MD55ad489994dd84e5ebdf4a4c858262558
SHA1808c0f184c42e0099054da50e2c92b8941baaee2
SHA25677e9649c149fda75f48307a0e0526417f9a1e2d709b6bd5bba7576edc0206a7f
SHA51272c2706f37ef5968c14f35ab6fe4dbb02b39d972326389b0070fbf46cee4f1ac4a7f6771700e48b825279f7baea04abbca839f6547eebcd8e4908f2f1509999c