Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-06-2024 17:09
Static task
static1
Behavioral task
behavioral1
Sample
bd6e635eb276e8dcb66e112c14454b88_JaffaCakes118.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
bd6e635eb276e8dcb66e112c14454b88_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
bd6e635eb276e8dcb66e112c14454b88_JaffaCakes118.exe
-
Size
1.0MB
-
MD5
bd6e635eb276e8dcb66e112c14454b88
-
SHA1
492ff5a1a1df6fd3522a05ca3dce4263b45250ff
-
SHA256
88db3859ec12ea8a91a86e58fa3b34a5c2688ba7f61ebd06567213e3e068d0c1
-
SHA512
155cd73dcc552de4f476898e54244a81adcb7af5821f54ad9f73b9b152a67581ba911ca89efc43a67dfcd7865b2fbd495706615c85cf8115a4e9bfcc613fc3e5
-
SSDEEP
12288:wM/VGR9lbM/VGR9lHwo+hFMjquAVYh1YBkQQB86+TZW:B/VGe/VGj+hyjFAV4yBk7B8LTZW
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation bd6e635eb276e8dcb66e112c14454b88_JaffaCakes118.exe -
Executes dropped EXE 2 IoCs
pid Process 2816 bd6e635eb276e8dcb66e112c14454b88_jaffacakes118.exe 3248 bd6e635eb276e8dcb66e112c14454b88_jaffacakes118.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Informations = "\\Informations\\Calme.exe" bd6e635eb276e8dcb66e112c14454b88_jaffacakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Informations = "C:\\Users\\Admin\\AppData\\Roaming\\Informations\\Calme.exe" bd6e635eb276e8dcb66e112c14454b88_jaffacakes118.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2364 set thread context of 4620 2364 bd6e635eb276e8dcb66e112c14454b88_JaffaCakes118.exe 85 PID 2816 set thread context of 3248 2816 bd6e635eb276e8dcb66e112c14454b88_jaffacakes118.exe 92 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 5080 PING.EXE -
Suspicious behavior: EnumeratesProcesses 44 IoCs
pid Process 4620 bd6e635eb276e8dcb66e112c14454b88_JaffaCakes118.exe 4620 bd6e635eb276e8dcb66e112c14454b88_JaffaCakes118.exe 4620 bd6e635eb276e8dcb66e112c14454b88_JaffaCakes118.exe 4620 bd6e635eb276e8dcb66e112c14454b88_JaffaCakes118.exe 4620 bd6e635eb276e8dcb66e112c14454b88_JaffaCakes118.exe 4620 bd6e635eb276e8dcb66e112c14454b88_JaffaCakes118.exe 4620 bd6e635eb276e8dcb66e112c14454b88_JaffaCakes118.exe 4620 bd6e635eb276e8dcb66e112c14454b88_JaffaCakes118.exe 4620 bd6e635eb276e8dcb66e112c14454b88_JaffaCakes118.exe 4620 bd6e635eb276e8dcb66e112c14454b88_JaffaCakes118.exe 4620 bd6e635eb276e8dcb66e112c14454b88_JaffaCakes118.exe 4620 bd6e635eb276e8dcb66e112c14454b88_JaffaCakes118.exe 4620 bd6e635eb276e8dcb66e112c14454b88_JaffaCakes118.exe 4620 bd6e635eb276e8dcb66e112c14454b88_JaffaCakes118.exe 4620 bd6e635eb276e8dcb66e112c14454b88_JaffaCakes118.exe 4620 bd6e635eb276e8dcb66e112c14454b88_JaffaCakes118.exe 4620 bd6e635eb276e8dcb66e112c14454b88_JaffaCakes118.exe 4620 bd6e635eb276e8dcb66e112c14454b88_JaffaCakes118.exe 4620 bd6e635eb276e8dcb66e112c14454b88_JaffaCakes118.exe 4620 bd6e635eb276e8dcb66e112c14454b88_JaffaCakes118.exe 4620 bd6e635eb276e8dcb66e112c14454b88_JaffaCakes118.exe 4620 bd6e635eb276e8dcb66e112c14454b88_JaffaCakes118.exe 4620 bd6e635eb276e8dcb66e112c14454b88_JaffaCakes118.exe 3248 bd6e635eb276e8dcb66e112c14454b88_jaffacakes118.exe 3248 bd6e635eb276e8dcb66e112c14454b88_jaffacakes118.exe 3248 bd6e635eb276e8dcb66e112c14454b88_jaffacakes118.exe 3248 bd6e635eb276e8dcb66e112c14454b88_jaffacakes118.exe 3248 bd6e635eb276e8dcb66e112c14454b88_jaffacakes118.exe 3248 bd6e635eb276e8dcb66e112c14454b88_jaffacakes118.exe 3248 bd6e635eb276e8dcb66e112c14454b88_jaffacakes118.exe 3248 bd6e635eb276e8dcb66e112c14454b88_jaffacakes118.exe 3248 bd6e635eb276e8dcb66e112c14454b88_jaffacakes118.exe 3248 bd6e635eb276e8dcb66e112c14454b88_jaffacakes118.exe 3248 bd6e635eb276e8dcb66e112c14454b88_jaffacakes118.exe 3248 bd6e635eb276e8dcb66e112c14454b88_jaffacakes118.exe 3248 bd6e635eb276e8dcb66e112c14454b88_jaffacakes118.exe 3248 bd6e635eb276e8dcb66e112c14454b88_jaffacakes118.exe 3248 bd6e635eb276e8dcb66e112c14454b88_jaffacakes118.exe 3248 bd6e635eb276e8dcb66e112c14454b88_jaffacakes118.exe 3248 bd6e635eb276e8dcb66e112c14454b88_jaffacakes118.exe 3248 bd6e635eb276e8dcb66e112c14454b88_jaffacakes118.exe 3248 bd6e635eb276e8dcb66e112c14454b88_jaffacakes118.exe 3248 bd6e635eb276e8dcb66e112c14454b88_jaffacakes118.exe 3248 bd6e635eb276e8dcb66e112c14454b88_jaffacakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3248 bd6e635eb276e8dcb66e112c14454b88_jaffacakes118.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 2364 bd6e635eb276e8dcb66e112c14454b88_JaffaCakes118.exe Token: SeDebugPrivilege 4620 bd6e635eb276e8dcb66e112c14454b88_JaffaCakes118.exe Token: SeDebugPrivilege 2816 bd6e635eb276e8dcb66e112c14454b88_jaffacakes118.exe Token: SeDebugPrivilege 3248 bd6e635eb276e8dcb66e112c14454b88_jaffacakes118.exe Token: 33 3248 bd6e635eb276e8dcb66e112c14454b88_jaffacakes118.exe Token: SeIncBasePriorityPrivilege 3248 bd6e635eb276e8dcb66e112c14454b88_jaffacakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3248 bd6e635eb276e8dcb66e112c14454b88_jaffacakes118.exe -
Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 2364 wrote to memory of 4620 2364 bd6e635eb276e8dcb66e112c14454b88_JaffaCakes118.exe 85 PID 2364 wrote to memory of 4620 2364 bd6e635eb276e8dcb66e112c14454b88_JaffaCakes118.exe 85 PID 2364 wrote to memory of 4620 2364 bd6e635eb276e8dcb66e112c14454b88_JaffaCakes118.exe 85 PID 2364 wrote to memory of 4620 2364 bd6e635eb276e8dcb66e112c14454b88_JaffaCakes118.exe 85 PID 2364 wrote to memory of 4620 2364 bd6e635eb276e8dcb66e112c14454b88_JaffaCakes118.exe 85 PID 2364 wrote to memory of 4620 2364 bd6e635eb276e8dcb66e112c14454b88_JaffaCakes118.exe 85 PID 2364 wrote to memory of 4620 2364 bd6e635eb276e8dcb66e112c14454b88_JaffaCakes118.exe 85 PID 2364 wrote to memory of 4620 2364 bd6e635eb276e8dcb66e112c14454b88_JaffaCakes118.exe 85 PID 4620 wrote to memory of 2816 4620 bd6e635eb276e8dcb66e112c14454b88_JaffaCakes118.exe 88 PID 4620 wrote to memory of 2816 4620 bd6e635eb276e8dcb66e112c14454b88_JaffaCakes118.exe 88 PID 4620 wrote to memory of 2816 4620 bd6e635eb276e8dcb66e112c14454b88_JaffaCakes118.exe 88 PID 4620 wrote to memory of 1332 4620 bd6e635eb276e8dcb66e112c14454b88_JaffaCakes118.exe 89 PID 4620 wrote to memory of 1332 4620 bd6e635eb276e8dcb66e112c14454b88_JaffaCakes118.exe 89 PID 4620 wrote to memory of 1332 4620 bd6e635eb276e8dcb66e112c14454b88_JaffaCakes118.exe 89 PID 1332 wrote to memory of 5080 1332 cmd.exe 91 PID 1332 wrote to memory of 5080 1332 cmd.exe 91 PID 1332 wrote to memory of 5080 1332 cmd.exe 91 PID 2816 wrote to memory of 3248 2816 bd6e635eb276e8dcb66e112c14454b88_jaffacakes118.exe 92 PID 2816 wrote to memory of 3248 2816 bd6e635eb276e8dcb66e112c14454b88_jaffacakes118.exe 92 PID 2816 wrote to memory of 3248 2816 bd6e635eb276e8dcb66e112c14454b88_jaffacakes118.exe 92 PID 2816 wrote to memory of 3248 2816 bd6e635eb276e8dcb66e112c14454b88_jaffacakes118.exe 92 PID 2816 wrote to memory of 3248 2816 bd6e635eb276e8dcb66e112c14454b88_jaffacakes118.exe 92 PID 2816 wrote to memory of 3248 2816 bd6e635eb276e8dcb66e112c14454b88_jaffacakes118.exe 92 PID 2816 wrote to memory of 3248 2816 bd6e635eb276e8dcb66e112c14454b88_jaffacakes118.exe 92 PID 2816 wrote to memory of 3248 2816 bd6e635eb276e8dcb66e112c14454b88_jaffacakes118.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd6e635eb276e8dcb66e112c14454b88_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\bd6e635eb276e8dcb66e112c14454b88_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\bd6e635eb276e8dcb66e112c14454b88_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\bd6e635eb276e8dcb66e112c14454b88_JaffaCakes118.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\bd6e635eb276e8dcb66e112c14454b88_jaffacakes118\bd6e635eb276e8dcb66e112c14454b88_jaffacakes118.exe"C:\Users\Admin\AppData\Local\Temp\bd6e635eb276e8dcb66e112c14454b88_jaffacakes118\bd6e635eb276e8dcb66e112c14454b88_jaffacakes118.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\bd6e635eb276e8dcb66e112c14454b88_jaffacakes118\bd6e635eb276e8dcb66e112c14454b88_jaffacakes118.exe"C:\Users\Admin\AppData\Local\Temp\bd6e635eb276e8dcb66e112c14454b88_jaffacakes118\bd6e635eb276e8dcb66e112c14454b88_jaffacakes118.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3248
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 1000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\bd6e635eb276e8dcb66e112c14454b88_JaffaCakes118.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 10004⤵
- Runs ping.exe
PID:5080
-
-
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:3276
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\bd6e635eb276e8dcb66e112c14454b88_jaffacakes118.exe.log
Filesize1KB
MD567ddf224adc71096f67a76084aa3a414
SHA144a5867b1414487c178ab1371d9db71fca0cb9c9
SHA2566520e15bd86fc89ae41b1a72521ec35aab8e5f7472fe0dad2ee378d115d3a314
SHA512d953d0124a731411ca6123f26deba36f9dbea2b02ad16115bc90d7f88371f4056733195dc705648d81d9696b03d0ca76ec269be56d41608339abe086ab6c89f1
-
C:\Users\Admin\AppData\Local\Temp\bd6e635eb276e8dcb66e112c14454b88_jaffacakes118\bd6e635eb276e8dcb66e112c14454b88_jaffacakes118.exe
Filesize1.0MB
MD5bd6e635eb276e8dcb66e112c14454b88
SHA1492ff5a1a1df6fd3522a05ca3dce4263b45250ff
SHA25688db3859ec12ea8a91a86e58fa3b34a5c2688ba7f61ebd06567213e3e068d0c1
SHA512155cd73dcc552de4f476898e54244a81adcb7af5821f54ad9f73b9b152a67581ba911ca89efc43a67dfcd7865b2fbd495706615c85cf8115a4e9bfcc613fc3e5
-
Filesize
53B
MD5ec32a9268b5de1a8bbd76a3dd4ddafe6
SHA1557f48e15512c4ab101b2fb3d5969a4f55619ff8
SHA256eed9db28f7ea2573691ff175d7dfe777e090fdc37b009c79427f43cd3db0ea29
SHA5128770b81c675801d75625d0d04976159b2a33ca253b67c7fdd5fd72c1c8d179325ce0dd07cf196b54bdaaa6f93b8c32ea454662cd32ec94b9c479e25741415cf2