Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
22-06-2024 17:21
Behavioral task
behavioral1
Sample
03210cf681bc7de73a54a5062fe7bc87_JaffaCakes118.exe
Resource
win7-20240220-en
General
-
Target
03210cf681bc7de73a54a5062fe7bc87_JaffaCakes118.exe
-
Size
156KB
-
MD5
03210cf681bc7de73a54a5062fe7bc87
-
SHA1
14aebef1f9d5d44ea4d0e0a740ddb19e8870522d
-
SHA256
54dc254338e6a99e689c8d64063c55439c2aba4d135eeec55dc345afc2338ca1
-
SHA512
6b9a59a93783a32ec039dabaefa94bd1d671b4d42a1f14bc066330f3aea5ea86ac7c38358fc6d7beff71ad5ca17d496a6b582bf60fbed610fced56a1ec0248b8
-
SSDEEP
1536:yXZ56F5r5JZJWEtVpFqN9BBKweuVHZJ71/j+suPG0Hc18yPsWjcdWny6k04yW/Xe:yp56zRJ83+OJ7NoGvdwWy6k04yW/KNb
Malware Config
Extracted
urelas
218.54.47.76
218.54.47.77
218.54.47.74
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
03210cf681bc7de73a54a5062fe7bc87_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation 03210cf681bc7de73a54a5062fe7bc87_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
Processes:
biudfw.exepid process 3892 biudfw.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
03210cf681bc7de73a54a5062fe7bc87_JaffaCakes118.exedescription pid process target process PID 2444 wrote to memory of 3892 2444 03210cf681bc7de73a54a5062fe7bc87_JaffaCakes118.exe biudfw.exe PID 2444 wrote to memory of 3892 2444 03210cf681bc7de73a54a5062fe7bc87_JaffaCakes118.exe biudfw.exe PID 2444 wrote to memory of 3892 2444 03210cf681bc7de73a54a5062fe7bc87_JaffaCakes118.exe biudfw.exe PID 2444 wrote to memory of 2672 2444 03210cf681bc7de73a54a5062fe7bc87_JaffaCakes118.exe cmd.exe PID 2444 wrote to memory of 2672 2444 03210cf681bc7de73a54a5062fe7bc87_JaffaCakes118.exe cmd.exe PID 2444 wrote to memory of 2672 2444 03210cf681bc7de73a54a5062fe7bc87_JaffaCakes118.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\03210cf681bc7de73a54a5062fe7bc87_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\03210cf681bc7de73a54a5062fe7bc87_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\biudfw.exe"C:\Users\Admin\AppData\Local\Temp\biudfw.exe"2⤵
- Executes dropped EXE
PID:3892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "2⤵PID:2672
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\biudfw.exeFilesize
156KB
MD570688873797aec63c43586c657d31ca2
SHA12311e1594ab33d2715c17a38907ff4ee7c2246cd
SHA25606247c68a63fc050ef5f9a408626d85cc9896a878e01035d684bb09b89b70742
SHA512eef17c420803dbd355a511ba3785fff76bd8cfa28d55865450b0d6d3ed640e9111d4fbe331c771d005462ae59fe09e85d741620b6565be2aaf6a1039cd6e230f
-
C:\Users\Admin\AppData\Local\Temp\golfinfo.iniFilesize
512B
MD5ac5e84ed8031d66a9fcd5e472ba8091b
SHA106303add604104d6abbb69458f89773c066b470c
SHA2563a3cfa6f4786dab0ac8bc76204948f32a3a2cbd094922f87c251ec80d22baae5
SHA5127bf829102a70a1304dae435b8ae3c9ef9a925af7e995fe381d80730f4f702e1fd2a0a1b6a3a4b4667925f5bb95c897166a8fc0f52d3171d9cdba0bf09b53f152
-
C:\Users\Admin\AppData\Local\Temp\sanfdr.batFilesize
302B
MD5ad3ecdda1cac91103547223816b0508b
SHA1707980d1c1c2948184d96ce4b66daa9f86257f20
SHA256eaa4c6fdd5e8d0707e56835821607d08c77bf47c2e13eebefef9a02892b968c9
SHA512efca21b463252375e4e7da99b7a927d76606c4b08308fd2b30bd0092d686092d7a55536d8c162cb632eca90162391e13c6fd60623c49f4e4bb98157d7a7568f2
-
memory/2444-0-0x0000000000930000-0x000000000095B000-memory.dmpFilesize
172KB
-
memory/2444-17-0x0000000000930000-0x000000000095B000-memory.dmpFilesize
172KB
-
memory/3892-15-0x00000000004B0000-0x00000000004DB000-memory.dmpFilesize
172KB
-
memory/3892-20-0x00000000004B0000-0x00000000004DB000-memory.dmpFilesize
172KB