Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
26-06-2024 17:58
Static task
static1
Behavioral task
behavioral1
Sample
12e32d071bd60abaa851badbdf8380ca_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
12e32d071bd60abaa851badbdf8380ca_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
12e32d071bd60abaa851badbdf8380ca_JaffaCakes118.exe
-
Size
524KB
-
MD5
12e32d071bd60abaa851badbdf8380ca
-
SHA1
084046c68b57bc33e8479f45ddcae647815700af
-
SHA256
8b9d0b2e7cb48a718e79d69f9c8ca135b089f9fd18ef5ac1662887b747945f62
-
SHA512
72f4d42a05112f94cbbb7237a1f2d14dc6612485ac0f43940bcf8486093a5b596b61b46d0fdfb8ce7d2d4764aabab15a01f073bb893f9594440d1c36529360c3
-
SSDEEP
6144:TEo1tixU698GYaez7vCuGISVTJZCgyFhXi9R037lnwtpxsvCIb/wTYBG0d7gbtNV:AU69zsvxTgSgiXie7lTv1/Gea8U
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
12e32d071bd60abaa851badbdf8380ca_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation 12e32d071bd60abaa851badbdf8380ca_JaffaCakes118.exe -
Executes dropped EXE 2 IoCs
Processes:
winini.exewinhost.exepid process 4308 winini.exe 3400 winhost.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
winini.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Live = "C:\\Users\\Admin\\AppData\\Local\\Temp\\winini.exe" winini.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
winini.exedescription pid process target process PID 4308 set thread context of 3400 4308 winini.exe winhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 25 IoCs
Processes:
winini.exewinhost.exedescription pid process Token: SeDebugPrivilege 4308 winini.exe Token: SeIncreaseQuotaPrivilege 3400 winhost.exe Token: SeSecurityPrivilege 3400 winhost.exe Token: SeTakeOwnershipPrivilege 3400 winhost.exe Token: SeLoadDriverPrivilege 3400 winhost.exe Token: SeSystemProfilePrivilege 3400 winhost.exe Token: SeSystemtimePrivilege 3400 winhost.exe Token: SeProfSingleProcessPrivilege 3400 winhost.exe Token: SeIncBasePriorityPrivilege 3400 winhost.exe Token: SeCreatePagefilePrivilege 3400 winhost.exe Token: SeBackupPrivilege 3400 winhost.exe Token: SeRestorePrivilege 3400 winhost.exe Token: SeShutdownPrivilege 3400 winhost.exe Token: SeDebugPrivilege 3400 winhost.exe Token: SeSystemEnvironmentPrivilege 3400 winhost.exe Token: SeChangeNotifyPrivilege 3400 winhost.exe Token: SeRemoteShutdownPrivilege 3400 winhost.exe Token: SeUndockPrivilege 3400 winhost.exe Token: SeManageVolumePrivilege 3400 winhost.exe Token: SeImpersonatePrivilege 3400 winhost.exe Token: SeCreateGlobalPrivilege 3400 winhost.exe Token: 33 3400 winhost.exe Token: 34 3400 winhost.exe Token: 35 3400 winhost.exe Token: 36 3400 winhost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
winhost.exepid process 3400 winhost.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
12e32d071bd60abaa851badbdf8380ca_JaffaCakes118.exewinini.exedescription pid process target process PID 2736 wrote to memory of 4308 2736 12e32d071bd60abaa851badbdf8380ca_JaffaCakes118.exe winini.exe PID 2736 wrote to memory of 4308 2736 12e32d071bd60abaa851badbdf8380ca_JaffaCakes118.exe winini.exe PID 2736 wrote to memory of 4308 2736 12e32d071bd60abaa851badbdf8380ca_JaffaCakes118.exe winini.exe PID 4308 wrote to memory of 3400 4308 winini.exe winhost.exe PID 4308 wrote to memory of 3400 4308 winini.exe winhost.exe PID 4308 wrote to memory of 3400 4308 winini.exe winhost.exe PID 4308 wrote to memory of 3400 4308 winini.exe winhost.exe PID 4308 wrote to memory of 3400 4308 winini.exe winhost.exe PID 4308 wrote to memory of 3400 4308 winini.exe winhost.exe PID 4308 wrote to memory of 3400 4308 winini.exe winhost.exe PID 4308 wrote to memory of 3400 4308 winini.exe winhost.exe PID 4308 wrote to memory of 3400 4308 winini.exe winhost.exe PID 4308 wrote to memory of 3400 4308 winini.exe winhost.exe PID 4308 wrote to memory of 3400 4308 winini.exe winhost.exe PID 4308 wrote to memory of 3400 4308 winini.exe winhost.exe PID 4308 wrote to memory of 3400 4308 winini.exe winhost.exe PID 4308 wrote to memory of 3400 4308 winini.exe winhost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\12e32d071bd60abaa851badbdf8380ca_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\12e32d071bd60abaa851badbdf8380ca_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\winini.exe"C:\Users\Admin\AppData\Local\Temp\winini.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\winhost.exeC:\Users\Admin\AppData\Local\Temp\winhost.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3400
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
34KB
MD5e118330b4629b12368d91b9df6488be0
SHA1ce90218c7e3b90df2a3409ec253048bb6472c2fd
SHA2563a0f2936b8c45e8ba3458d69d7859a63844469e698652e15fb56639d32f40cc9
SHA512ac91c04cb20223dbaaf594440cb778dff36e857921be427c8528ba4c6cdb3e8bf8e71e1ae8af7bde9c04ff5b97b379231625bc1a2b66aba2f98cd340cd8a94b0
-
Filesize
452KB
MD501e496c7cf56a31a6769ec324ee55eb5
SHA155d1a8c7e5f5dd7f7fa4dd6ca276db3cc1cec312
SHA256984a85e4241d408d36e837e305134721306d849393af11ef412e70f0ac239830
SHA512765ffaa9de317a734009ce084ba6478ec24b2e185647d8b2eeb472e37caf8ab834e5a8f6f4241bba28380f8a2fcf1dd0ba1db6154c74302487bab5e8bab9a984