Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 00:00
Static task
static1
Behavioral task
behavioral1
Sample
5788d42e58d439488f7e718d640c4901_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
5788d42e58d439488f7e718d640c4901_JaffaCakes118.exe
Resource
win10v2004-20240426-en
General
-
Target
5788d42e58d439488f7e718d640c4901_JaffaCakes118.exe
-
Size
1.0MB
-
MD5
5788d42e58d439488f7e718d640c4901
-
SHA1
979c0bbc2afdf4860682109a4b700b6a9ca68f60
-
SHA256
b687d346a7da664fb96a4dbc3b23aa5568ce1eb5229fbe6639351020993564f9
-
SHA512
ead1ceb3139e93703e5891120ede5df2ee452c5daa545e6078ae8b9e49f580d5bf90366a04e48061fcdcaa01fcadde7d13d198c329a54958a85df039e07b876d
-
SSDEEP
12288:b+SaTrGeI1rkydoPN1X6gti6w5kwIj1VykTSp35FAC5YwGNJwW8rc2baI:b+MeUrkydsfb5twI5VxTIJFAe
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
5788d42e58d439488f7e718d640c4901_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation 5788d42e58d439488f7e718d640c4901_JaffaCakes118.exe -
Executes dropped EXE 2 IoCs
Processes:
SqlHosts.exeSqlHosts.exepid process 2040 SqlHosts.exe 3444 SqlHosts.exe -
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral2/memory/4664-2-0x0000000005A20000-0x0000000005A48000-memory.dmp agile_net -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
SqlHosts.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Sql Hosts = "C:\\Users\\Admin\\AppData\\Local\\SqlHosts.exe -boot" SqlHosts.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
SqlHosts.exedescription pid process target process PID 2040 set thread context of 3444 2040 SqlHosts.exe SqlHosts.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
SqlHosts.exepid process 3444 SqlHosts.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
5788d42e58d439488f7e718d640c4901_JaffaCakes118.exeSqlHosts.exeSqlHosts.exedescription pid process Token: SeDebugPrivilege 4664 5788d42e58d439488f7e718d640c4901_JaffaCakes118.exe Token: SeDebugPrivilege 2040 SqlHosts.exe Token: SeDebugPrivilege 3444 SqlHosts.exe Token: 33 3444 SqlHosts.exe Token: SeIncBasePriorityPrivilege 3444 SqlHosts.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
SqlHosts.exepid process 3444 SqlHosts.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
5788d42e58d439488f7e718d640c4901_JaffaCakes118.exeexplorer.exeSqlHosts.exedescription pid process target process PID 4664 wrote to memory of 2408 4664 5788d42e58d439488f7e718d640c4901_JaffaCakes118.exe cmd.exe PID 4664 wrote to memory of 2408 4664 5788d42e58d439488f7e718d640c4901_JaffaCakes118.exe cmd.exe PID 4664 wrote to memory of 2408 4664 5788d42e58d439488f7e718d640c4901_JaffaCakes118.exe cmd.exe PID 4664 wrote to memory of 3852 4664 5788d42e58d439488f7e718d640c4901_JaffaCakes118.exe explorer.exe PID 4664 wrote to memory of 3852 4664 5788d42e58d439488f7e718d640c4901_JaffaCakes118.exe explorer.exe PID 4664 wrote to memory of 3852 4664 5788d42e58d439488f7e718d640c4901_JaffaCakes118.exe explorer.exe PID 4296 wrote to memory of 2040 4296 explorer.exe SqlHosts.exe PID 4296 wrote to memory of 2040 4296 explorer.exe SqlHosts.exe PID 4296 wrote to memory of 2040 4296 explorer.exe SqlHosts.exe PID 2040 wrote to memory of 3444 2040 SqlHosts.exe SqlHosts.exe PID 2040 wrote to memory of 3444 2040 SqlHosts.exe SqlHosts.exe PID 2040 wrote to memory of 3444 2040 SqlHosts.exe SqlHosts.exe PID 2040 wrote to memory of 3444 2040 SqlHosts.exe SqlHosts.exe PID 2040 wrote to memory of 3444 2040 SqlHosts.exe SqlHosts.exe PID 2040 wrote to memory of 3444 2040 SqlHosts.exe SqlHosts.exe PID 2040 wrote to memory of 3444 2040 SqlHosts.exe SqlHosts.exe PID 2040 wrote to memory of 3444 2040 SqlHosts.exe SqlHosts.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5788d42e58d439488f7e718d640c4901_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5788d42e58d439488f7e718d640c4901_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\5788d42e58d439488f7e718d640c4901_JaffaCakes118.exe" "C:\Users\Admin\AppData\Local\SqlHosts.exe"2⤵
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\System32\explorer.exe" /c, "C:\Users\Admin\AppData\Local\SqlHosts.exe"2⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\SqlHosts.exe"C:\Users\Admin\AppData\Local\SqlHosts.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\SqlHosts.exe"C:\Users\Admin\AppData\Local\SqlHosts.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SqlHosts.exe.logFilesize
706B
MD550844348fdbcc76c3d6af4e20831e544
SHA163dc1cb568c6d039120bf3dffc34d551b1966eae
SHA256a9145730178d9e3d68c5062935df818d3b5a5ed0bca29660896a710dfd74b644
SHA5128fbb15343fc9a425b47614c1621b6f167c2ff48766bb9fab0cf6dac21763043ce497bb74a2353743e49a7a4ffcd712a38e6348583a7076d4127fe8f6c33ac2b0
-
C:\Users\Admin\AppData\Local\SqlHosts.exeFilesize
1.0MB
MD55788d42e58d439488f7e718d640c4901
SHA1979c0bbc2afdf4860682109a4b700b6a9ca68f60
SHA256b687d346a7da664fb96a4dbc3b23aa5568ce1eb5229fbe6639351020993564f9
SHA512ead1ceb3139e93703e5891120ede5df2ee452c5daa545e6078ae8b9e49f580d5bf90366a04e48061fcdcaa01fcadde7d13d198c329a54958a85df039e07b876d
-
memory/2040-14-0x00000000061A0000-0x000000000623C000-memory.dmpFilesize
624KB
-
memory/3444-20-0x00000000058B0000-0x000000000595E000-memory.dmpFilesize
696KB
-
memory/3444-15-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/3444-25-0x0000000005AC0000-0x0000000005ACA000-memory.dmpFilesize
40KB
-
memory/3444-24-0x00000000080F0000-0x0000000008106000-memory.dmpFilesize
88KB
-
memory/3444-23-0x0000000007A40000-0x0000000007A58000-memory.dmpFilesize
96KB
-
memory/3444-22-0x0000000007930000-0x0000000007996000-memory.dmpFilesize
408KB
-
memory/3444-21-0x00000000056F0000-0x0000000005718000-memory.dmpFilesize
160KB
-
memory/3444-19-0x0000000001670000-0x0000000001680000-memory.dmpFilesize
64KB
-
memory/4664-11-0x00000000748E0000-0x0000000075090000-memory.dmpFilesize
7.7MB
-
memory/4664-1-0x0000000000FE0000-0x00000000010F6000-memory.dmpFilesize
1.1MB
-
memory/4664-2-0x0000000005A20000-0x0000000005A48000-memory.dmpFilesize
160KB
-
memory/4664-3-0x0000000006080000-0x0000000006624000-memory.dmpFilesize
5.6MB
-
memory/4664-0-0x00000000748EE000-0x00000000748EF000-memory.dmpFilesize
4KB
-
memory/4664-4-0x0000000005C10000-0x0000000005CA2000-memory.dmpFilesize
584KB
-
memory/4664-9-0x00000000748E0000-0x0000000075090000-memory.dmpFilesize
7.7MB
-
memory/4664-8-0x00000000748EE000-0x00000000748EF000-memory.dmpFilesize
4KB
-
memory/4664-5-0x00000000748E0000-0x0000000075090000-memory.dmpFilesize
7.7MB