Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
15/06/2024, 19:16
Static task
static1
Behavioral task
behavioral1
Sample
aff24f3d5b86c1a8592b38b609350c54_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
aff24f3d5b86c1a8592b38b609350c54_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
aff24f3d5b86c1a8592b38b609350c54_JaffaCakes118.exe
-
Size
21.1MB
-
MD5
aff24f3d5b86c1a8592b38b609350c54
-
SHA1
3f28f02e948095e8e3f3a2abd3328fbc281ea7b7
-
SHA256
d79db4c19cb70ffec4ac9c75564a51069fea23a8839d3f0267eae20d9ee1f9e4
-
SHA512
dd390400957bad58621f67184924e6bf6764f393121da705c08d7e7b9bf573169b2697dc840dd26b96fc45ded24d687eda6c833e5e68edccd3d24c6d7dc92065
-
SSDEEP
393216:5VjSEPbi7v4SUJIS7kqyOOmUa07h9FI+gB0hLuhu4D3f/s2dXhMEv:zdy4PIS7kHdaiLFGg4D3f/sov
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation aff24f3d5b86c1a8592b38b609350c54_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 1404 irsetup.exe -
Loads dropped DLL 1 IoCs
pid Process 1404 irsetup.exe -
resource yara_rule behavioral2/files/0x000900000002341e-5.dat upx behavioral2/memory/1404-14-0x0000000000D50000-0x0000000001137000-memory.dmp upx behavioral2/memory/1404-26-0x0000000000D50000-0x0000000001137000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1404 irsetup.exe 1404 irsetup.exe 1404 irsetup.exe 1404 irsetup.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4820 wrote to memory of 1404 4820 aff24f3d5b86c1a8592b38b609350c54_JaffaCakes118.exe 85 PID 4820 wrote to memory of 1404 4820 aff24f3d5b86c1a8592b38b609350c54_JaffaCakes118.exe 85 PID 4820 wrote to memory of 1404 4820 aff24f3d5b86c1a8592b38b609350c54_JaffaCakes118.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\aff24f3d5b86c1a8592b38b609350c54_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\aff24f3d5b86c1a8592b38b609350c54_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1939202 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\aff24f3d5b86c1a8592b38b609350c54_JaffaCakes118.exe" "__IRCT:0" "__IRTSS:0" "__IRSID:S-1-5-21-4124900551-4068476067-3491212533-1000"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1404
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD59bdcf813d65265255b820bc7a704da3c
SHA1dad6501711992ab874d778ece5a103e143fd42d7
SHA256b15d67b4a57184e5202df3c25e20dc0b7f853f4d527d148b337138900989824a
SHA51253cac68a57194ec33ccc5c212a6b82bc554e85c86faab4e095876f5c037f680c646ce8463857e61438b92cb7ca7c17efea1d713a9d772d9f2afeb5ddd17b6504
-
Filesize
322KB
MD5c3f5f4a1fb69b5889f0bbb313cf6017f
SHA1e4f592cfbd62a3c3caf27177ccea5a77afa649bb
SHA256769416fa7edf38e91a55f4f7163914ee4aad9c8c890ed641c300b73157acac45
SHA512e17d3be36fd2ba892d945f3737ebffdefe6d476224ef3459b567579971559a048a886941f57ae671b3df32844f99575a14c72ef8c49c2d4b1e8352204ccc05ab