Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 02:46
Static task
static1
Behavioral task
behavioral1
Sample
65be8c88b60ace74d5782e4c3b5ae74f_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
65be8c88b60ace74d5782e4c3b5ae74f_JaffaCakes118.exe
Resource
win10v2004-20240426-en
General
-
Target
65be8c88b60ace74d5782e4c3b5ae74f_JaffaCakes118.exe
-
Size
471KB
-
MD5
65be8c88b60ace74d5782e4c3b5ae74f
-
SHA1
d04c965a9d071ee5cb7dae7077e295ed4ad259a4
-
SHA256
1172ffa7cd7b3b619eebbf27b7642bc44698c0faa1379d91380495fede507f36
-
SHA512
805bd87488528614dfa40b2d4acad86ca7db55817aa751a7a057e4790d57291cb6de9db60eb760bc37fb7ff604c1b663d337ba7b1e383271e3ad505520d7c0b5
-
SSDEEP
6144:9msyd7BspOWZ+Stxo3Gc2uqy3gu88mWCMpCRWFf2Kj+m+6XjYA1:ppO3StxwGc2c3tfmfsCRA22+m+8f1
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
65be8c88b60ace74d5782e4c3b5ae74f_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 65be8c88b60ace74d5782e4c3b5ae74f_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
Processes:
worker.exepid process 4344 worker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
worker.exedescription pid process Token: SeDebugPrivilege 4344 worker.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
worker.exepid process 4344 worker.exe 4344 worker.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
65be8c88b60ace74d5782e4c3b5ae74f_JaffaCakes118.exedescription pid process target process PID 2740 wrote to memory of 4344 2740 65be8c88b60ace74d5782e4c3b5ae74f_JaffaCakes118.exe worker.exe PID 2740 wrote to memory of 4344 2740 65be8c88b60ace74d5782e4c3b5ae74f_JaffaCakes118.exe worker.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\65be8c88b60ace74d5782e4c3b5ae74f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\65be8c88b60ace74d5782e4c3b5ae74f_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DM\worker.exe"C:\Users\Admin\AppData\Local\Temp\DM\worker.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\DM\parent.txtFilesize
471KB
MD565be8c88b60ace74d5782e4c3b5ae74f
SHA1d04c965a9d071ee5cb7dae7077e295ed4ad259a4
SHA2561172ffa7cd7b3b619eebbf27b7642bc44698c0faa1379d91380495fede507f36
SHA512805bd87488528614dfa40b2d4acad86ca7db55817aa751a7a057e4790d57291cb6de9db60eb760bc37fb7ff604c1b663d337ba7b1e383271e3ad505520d7c0b5
-
C:\Users\Admin\AppData\Local\Temp\DM\worker.exeFilesize
19KB
MD52b23c69b68708c14fc214c3454e6b1bd
SHA15c923d25c14ad13dab4f05bb1423026f873e7dc4
SHA256b2eb3b20cfa82a80207cb9fe8ea7cb28faa1b35612816b7b0052e68b9c8068bd
SHA51200135ff0664e9de5f98be600773c72025f5f338e7301ab9d10b023fef672baa2ddbe3124813352eacf8d7475f0905d68dded619aa2cc3099f10b943ff3cdb8c5
-
memory/4344-15-0x00007FFE63240000-0x00007FFE63BE1000-memory.dmpFilesize
9.6MB
-
memory/4344-19-0x00007FFE63240000-0x00007FFE63BE1000-memory.dmpFilesize
9.6MB
-
memory/4344-13-0x00007FFE63240000-0x00007FFE63BE1000-memory.dmpFilesize
9.6MB
-
memory/4344-16-0x000000001C030000-0x000000001C4FE000-memory.dmpFilesize
4.8MB
-
memory/4344-17-0x000000001C5A0000-0x000000001C63C000-memory.dmpFilesize
624KB
-
memory/4344-18-0x00000000011C0000-0x00000000011C8000-memory.dmpFilesize
32KB
-
memory/4344-20-0x00007FFE63240000-0x00007FFE63BE1000-memory.dmpFilesize
9.6MB
-
memory/4344-14-0x000000001B7A0000-0x000000001B7E4000-memory.dmpFilesize
272KB
-
memory/4344-21-0x00007FFE63240000-0x00007FFE63BE1000-memory.dmpFilesize
9.6MB
-
memory/4344-22-0x000000001E0F0000-0x000000001E152000-memory.dmpFilesize
392KB
-
memory/4344-12-0x00007FFE634F5000-0x00007FFE634F6000-memory.dmpFilesize
4KB
-
memory/4344-25-0x00007FFE63240000-0x00007FFE63BE1000-memory.dmpFilesize
9.6MB
-
memory/4344-34-0x00000000220B0000-0x0000000022856000-memory.dmpFilesize
7.6MB
-
memory/4344-35-0x0000000020790000-0x0000000020C47000-memory.dmpFilesize
4.7MB
-
memory/4344-36-0x00007FFE63240000-0x00007FFE63BE1000-memory.dmpFilesize
9.6MB
-
memory/4344-37-0x00007FFE634F5000-0x00007FFE634F6000-memory.dmpFilesize
4KB