Analysis
-
max time kernel
129s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
03/06/2024, 07:46
Static task
static1
Behavioral task
behavioral1
Sample
90ff3115ec5fb4ffb20bd2ee4a9e0984_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
90ff3115ec5fb4ffb20bd2ee4a9e0984_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
90ff3115ec5fb4ffb20bd2ee4a9e0984_JaffaCakes118.exe
-
Size
165KB
-
MD5
90ff3115ec5fb4ffb20bd2ee4a9e0984
-
SHA1
dc3425ac8f2da269be8145d68cbf35cf0f6b9618
-
SHA256
06dcf0380bc567ba8e97ee6aca99f55107ee4b78be4835b42bcce46c621af9e8
-
SHA512
a4b83f6c3a45b6ac48d583b3a835f605a80a0ebdc48f2d6ce1626ef420e67cbda5f29f87455cda5fa7cfe5a230fd4e2de1915b6c766813389f5336f771de7561
-
SSDEEP
3072:c4HCWau/PlYeuL7ZLFh6Ca6cbL9l2hzB3fJCC6j8+Er6ez4n:ziI/PlY37ZLF4Ca6WABqBOvsn
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 90ff3115ec5fb4ffb20bd2ee4a9e0984_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 4208 ins2350.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created C:\Windows\assembly\Desktop.ini ins2350.exe File opened for modification C:\Windows\assembly\Desktop.ini ins2350.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\assembly ins2350.exe File created C:\Windows\assembly\Desktop.ini ins2350.exe File opened for modification C:\Windows\assembly\Desktop.ini ins2350.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 4208 ins2350.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4208 ins2350.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4208 ins2350.exe 4208 ins2350.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3588 wrote to memory of 4208 3588 90ff3115ec5fb4ffb20bd2ee4a9e0984_JaffaCakes118.exe 84 PID 3588 wrote to memory of 4208 3588 90ff3115ec5fb4ffb20bd2ee4a9e0984_JaffaCakes118.exe 84 PID 3588 wrote to memory of 4208 3588 90ff3115ec5fb4ffb20bd2ee4a9e0984_JaffaCakes118.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\90ff3115ec5fb4ffb20bd2ee4a9e0984_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\90ff3115ec5fb4ffb20bd2ee4a9e0984_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\ins2350\ins2350.exe"C:\Users\Admin\AppData\Local\Temp\ins2350\ins2350.exe" ins.exe /t1023b576cd9b950c8e7a8b9867a54c /e9504441 /uc44c0242-e47d-11e2-b66b-00259033c1da2⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4208
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
257KB
MD5ae117f47bd80e5dcf72cf81347fceb73
SHA11cd3e4c5fc9fb317b7a8eae6c94d53078800b635
SHA25649b0ec8a4000cb30f15b318bef4b6f59be2d0f7365be4c4b2b4fd5607e16e23c
SHA51272d322ec9b13e9ede1967707129f2941328ec75487aa5ea205eab0780ef26c33f253204ce08932052a6ed19d13bd62e68b4f795ef17717b9f31e5a76a9f0c16f