Analysis
-
max time kernel
142s -
max time network
51s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
21-06-2024 23:23
Static task
static1
Behavioral task
behavioral1
Sample
002c97086073bcdf6039973287a23635_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
002c97086073bcdf6039973287a23635_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
002c97086073bcdf6039973287a23635_JaffaCakes118.exe
-
Size
1.4MB
-
MD5
002c97086073bcdf6039973287a23635
-
SHA1
47486fca88e6ed5fc99d6841e8ff86b1697d927a
-
SHA256
48e0b6f0c80584a30e3af4a58bbfba0bb4daf2c72cad888b00d8418d78a87ad7
-
SHA512
6ffcd74bc731f9fcce583e46de13078adbc6d17093371ede479077d778fb728a3dbde5007a304df41e012aa4a66c21afc49081bf20675e24933a58e666ced633
-
SSDEEP
24576:romcKjdLdlmcojdLdkZfvKxUpXBU1YlPFyBZfvKxUpXBU1YlPFy+:XcKjdRccojdRgvo2BoUUvo2BoUp
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
002c97086073bcdf6039973287a23635_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 002c97086073bcdf6039973287a23635_JaffaCakes118.exe -
Executes dropped EXE 2 IoCs
Processes:
Kryptonite.exe111.exepid process 2336 Kryptonite.exe 3352 111.exe -
Drops file in Windows directory 2 IoCs
Processes:
002c97086073bcdf6039973287a23635_JaffaCakes118.exedescription ioc process File opened for modification C:\Windows\Kryptonite.exe 002c97086073bcdf6039973287a23635_JaffaCakes118.exe File opened for modification C:\Windows\111.exe 002c97086073bcdf6039973287a23635_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
111.exedescription pid process Token: SeDebugPrivilege 3352 111.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
002c97086073bcdf6039973287a23635_JaffaCakes118.exepid process 2684 002c97086073bcdf6039973287a23635_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
002c97086073bcdf6039973287a23635_JaffaCakes118.exe111.exedescription pid process target process PID 2684 wrote to memory of 2336 2684 002c97086073bcdf6039973287a23635_JaffaCakes118.exe Kryptonite.exe PID 2684 wrote to memory of 2336 2684 002c97086073bcdf6039973287a23635_JaffaCakes118.exe Kryptonite.exe PID 2684 wrote to memory of 2336 2684 002c97086073bcdf6039973287a23635_JaffaCakes118.exe Kryptonite.exe PID 2684 wrote to memory of 3352 2684 002c97086073bcdf6039973287a23635_JaffaCakes118.exe 111.exe PID 2684 wrote to memory of 3352 2684 002c97086073bcdf6039973287a23635_JaffaCakes118.exe 111.exe PID 2684 wrote to memory of 3352 2684 002c97086073bcdf6039973287a23635_JaffaCakes118.exe 111.exe PID 3352 wrote to memory of 552 3352 111.exe 111.exe PID 3352 wrote to memory of 552 3352 111.exe 111.exe PID 3352 wrote to memory of 552 3352 111.exe 111.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\002c97086073bcdf6039973287a23635_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\002c97086073bcdf6039973287a23635_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Kryptonite.exe"C:\Windows\Kryptonite.exe"2⤵
- Executes dropped EXE
-
C:\Windows\111.exe"C:\Windows\111.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\111.exeC:\Windows\111.exe3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\111.exeFilesize
917KB
MD57dc6cfcfbbc42c597ca18216cad9ffc9
SHA18e7c10b41821a9723a2b0259d1d7c410a0e8d855
SHA256be8ef5a37e1171c02716d0c25ef333a4a8fa3aac95ede79aafc19b4afe4e8729
SHA512b2233bfd048ac3d61ef6c815249d9faad50bd7517d54e82a3256cca5fe22de36f77ab448004a751a08f94c6847a8a1fbceaab30f82fbd585cc2bd243518d5771
-
C:\Windows\Kryptonite.exeFilesize
434KB
MD5544f56f393eb5cd7c218bab8e9bc8bfd
SHA10b2b743f55c70de720a1095b1fbb69fe780058e5
SHA2568cc2225c42941d1546f1f8d8f0f1771ab6928339a9b140ff7c875a177bbb4e3b
SHA5126827dc484a8c6ea65aab65fbc4b58ff3979331d28dca7ff12f908a277934fe2656d00a8a87262534194d90c859896a06f361f2430dba780887fe7d9cd88b42b0
-
memory/2336-25-0x00000000735C0000-0x0000000073B71000-memory.dmpFilesize
5.7MB
-
memory/2336-26-0x00000000735C0000-0x0000000073B71000-memory.dmpFilesize
5.7MB
-
memory/2336-28-0x00000000735C0000-0x0000000073B71000-memory.dmpFilesize
5.7MB
-
memory/2336-30-0x00000000735C0000-0x0000000073B71000-memory.dmpFilesize
5.7MB
-
memory/2336-32-0x00000000735C0000-0x0000000073B71000-memory.dmpFilesize
5.7MB
-
memory/3352-24-0x00000000735C2000-0x00000000735C3000-memory.dmpFilesize
4KB
-
memory/3352-27-0x00000000735C0000-0x0000000073B71000-memory.dmpFilesize
5.7MB
-
memory/3352-29-0x00000000735C0000-0x0000000073B71000-memory.dmpFilesize
5.7MB
-
memory/3352-31-0x00000000735C0000-0x0000000073B71000-memory.dmpFilesize
5.7MB