Analysis
-
max time kernel
125s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24-06-2024 22:59
Static task
static1
Behavioral task
behavioral1
Sample
0b1df61b227c1c54396448932003425d_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
0b1df61b227c1c54396448932003425d_JaffaCakes118.exe
-
Size
59KB
-
MD5
0b1df61b227c1c54396448932003425d
-
SHA1
c996bc5bd17b16a6f1d007416cb8f2b3e0f2b8db
-
SHA256
21090104412d20f6def9eb54902ec06250ec445fd68867bcddf512b17a74591e
-
SHA512
7622ff717bde751d6d4e2aa8a3e532837e10e8d0bdc35a8de03dcc5526eadee0688f0730690a467fd0bd8679953466d5882eab5162814f8ee634b0453c071db7
-
SSDEEP
768:n5mhew0GpSyMe6hwUkdwJzh+qciaQRENEzxZbARtR06g2wqp4YPeznellmqGwxPo:nK0GjMeQG3iaQREuVZ6ro29p4YxbKdN
Malware Config
Extracted
urelas
218.54.47.76
218.54.47.77
218.54.47.74
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
0b1df61b227c1c54396448932003425d_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 0b1df61b227c1c54396448932003425d_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
Processes:
biudfw.exepid process 4316 biudfw.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
0b1df61b227c1c54396448932003425d_JaffaCakes118.exedescription pid process target process PID 3108 wrote to memory of 4316 3108 0b1df61b227c1c54396448932003425d_JaffaCakes118.exe biudfw.exe PID 3108 wrote to memory of 4316 3108 0b1df61b227c1c54396448932003425d_JaffaCakes118.exe biudfw.exe PID 3108 wrote to memory of 4316 3108 0b1df61b227c1c54396448932003425d_JaffaCakes118.exe biudfw.exe PID 3108 wrote to memory of 2568 3108 0b1df61b227c1c54396448932003425d_JaffaCakes118.exe cmd.exe PID 3108 wrote to memory of 2568 3108 0b1df61b227c1c54396448932003425d_JaffaCakes118.exe cmd.exe PID 3108 wrote to memory of 2568 3108 0b1df61b227c1c54396448932003425d_JaffaCakes118.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b1df61b227c1c54396448932003425d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0b1df61b227c1c54396448932003425d_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\biudfw.exe"C:\Users\Admin\AppData\Local\Temp\biudfw.exe"2⤵
- Executes dropped EXE
PID:4316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "2⤵PID:2568
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3812,i,13035806169561352434,1332896185314862791,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:81⤵PID:4456
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\biudfw.exeFilesize
59KB
MD55c88eda0e2838c0a789874b9f309ee5a
SHA128768ef819df0e183e8c8f1ae346babc77c4768a
SHA2564d7a6cdd576443b363af56c58fef74330c24fa5714da3f22d32cd119481fc819
SHA512dafe4851f5b842670560731657149279ab57b2249fd6b2e8d2af2582b15e9d1080223f464e5614e92cf631db0cf3a49c878669a448e84a9d7df7298434b7ff20
-
C:\Users\Admin\AppData\Local\Temp\golfinfo.iniFilesize
512B
MD555e10a9af74d3f3fa5ae3cb7ff5ad9d4
SHA1449221fd8d7196a54de2bd583625d8d1b64db56a
SHA256a945a44cfe50423c01f26a16445ed177a347052e791364a9cb7de6bcaa18f3c1
SHA5124af5ba74467b4c61302ea9571f19346c05f911843f2c6153fcd9a7340f9bc6e1f8867cdb72ec7ba0dc4930199aa5c302711ad5da9fd35241839418f6e70a515a
-
C:\Users\Admin\AppData\Local\Temp\sanfdr.batFilesize
302B
MD5de71fbf9d235ee2494a7649e10a98941
SHA1c8347871190c7f57d6ccdcb153daf719bd39e8bf
SHA256cc3fcfcaf3e860fca772f2159e997a34717bd27775c33e7a37e3087bee79cff7
SHA512ec3a5e65643345f3f62ea7ae87ec4283be31850f2bc5bb0edd2875a70474bdb64bd3fb3aaff8bf9779d1ecb840346a706e6d24b50ec438c52853052b8761f736
-
memory/3108-0-0x0000000000080000-0x00000000000B5000-memory.dmpFilesize
212KB
-
memory/3108-14-0x0000000000080000-0x00000000000B5000-memory.dmpFilesize
212KB
-
memory/4316-12-0x0000000000C80000-0x0000000000CB5000-memory.dmpFilesize
212KB
-
memory/4316-17-0x0000000000C80000-0x0000000000CB5000-memory.dmpFilesize
212KB
-
memory/4316-19-0x0000000000C80000-0x0000000000CB5000-memory.dmpFilesize
212KB
-
memory/4316-26-0x0000000000C80000-0x0000000000CB5000-memory.dmpFilesize
212KB