Analysis
-
max time kernel
129s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
28-06-2024 02:29
Static task
static1
Behavioral task
behavioral1
Sample
18760eae1da56df4e02c96e6a00781b6_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
18760eae1da56df4e02c96e6a00781b6_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
18760eae1da56df4e02c96e6a00781b6_JaffaCakes118.exe
-
Size
596KB
-
MD5
18760eae1da56df4e02c96e6a00781b6
-
SHA1
e7baea61816c90f8047edc46f9b591e0f28cfdbd
-
SHA256
86481521ec3a1fe780a6dab70518eff29453017674a6c34b606822220d52fa0a
-
SHA512
404379e1a60f3357eabf3603dcea25ac2ba2ac0012726e3ee9283afd2bdb9c1e6f2b870be2595eff9f4252f4ed59dfa8930131646efe2c324dd356409dcef637
-
SSDEEP
12288:LLaqQBLPSHeiB9Ea9yb1hHrDYJ5YBGwCbRfB8dCFD:aPPSFgaefYJ5NoCF
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
18760eae1da56df4e02c96e6a00781b6_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation 18760eae1da56df4e02c96e6a00781b6_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
Processes:
cYNhXOcmVV.exepid process 896 cYNhXOcmVV.exe -
Loads dropped DLL 4 IoCs
Processes:
cYNhXOcmVV.exepid process 896 cYNhXOcmVV.exe 896 cYNhXOcmVV.exe 896 cYNhXOcmVV.exe 896 cYNhXOcmVV.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
cYNhXOcmVV.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cYNhXOcmVV.exe = "C:\\Users\\Admin\\AppData\\Roaming\\PKLJOyGNdFEUKMEdGkiR\\PKLJOyGNdFEUKMEdGkiR\\0.0.0.0\\cYNhXOcmVV.exe" cYNhXOcmVV.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
18760eae1da56df4e02c96e6a00781b6_JaffaCakes118.exedescription pid process target process PID 3920 wrote to memory of 896 3920 18760eae1da56df4e02c96e6a00781b6_JaffaCakes118.exe cYNhXOcmVV.exe PID 3920 wrote to memory of 896 3920 18760eae1da56df4e02c96e6a00781b6_JaffaCakes118.exe cYNhXOcmVV.exe PID 3920 wrote to memory of 896 3920 18760eae1da56df4e02c96e6a00781b6_JaffaCakes118.exe cYNhXOcmVV.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\18760eae1da56df4e02c96e6a00781b6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\18760eae1da56df4e02c96e6a00781b6_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\wXicueBkvBxJao\wXicueBkvBxJao\1.0.1.0\cYNhXOcmVV.exe"C:\ProgramData\wXicueBkvBxJao\wXicueBkvBxJao\1.0.1.0\cYNhXOcmVV.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\wXicueBkvBxJao\wXicueBkvBxJao\1.0.1.0\cYNhXOcmVV.exeFilesize
428KB
MD57816803684cedaf35af65d77c32bc01d
SHA135916478563566c33d257b518eeb33df174c5d6e
SHA25651112b7779aebab85338ec70aaea769dc0a609ee16609a4fdb7fc9e97de085a3
SHA512c3199066ee8fc9b0fc44c8a66aa19bea35ae47af7c436175f04152026597159efcb3d9ab5a7275ae499c8d341b5890f26cb2e8c98d8a183735523a5e8cb33d75
-
C:\ProgramData\wXicueBkvBxJao\wXicueBkvBxJao\1.0.1.0\kernel32.dllFilesize
18KB
MD5e4b4f52d91c49da13fc81a654763bb61
SHA175b42b5236cbe8ff240a98f3553b17dc4a8ad7cb
SHA25645b2457fc46410edd11de51437e2561a661d37ebf2c3790db31876ad064be0d1
SHA512bcbb042be2ee1d848525e10784b473702a06d7818ad1acfd77cd624bf0750f9aa2d8d172bfe3a916b33561e20ce69a07009f23fbfffb509a54014cd2a58bd288
-
memory/896-16-0x00000000746C0000-0x0000000074C71000-memory.dmpFilesize
5.7MB
-
memory/896-37-0x00000000746C0000-0x0000000074C71000-memory.dmpFilesize
5.7MB
-
memory/3920-0-0x00000000746C2000-0x00000000746C3000-memory.dmpFilesize
4KB
-
memory/3920-1-0x00000000746C0000-0x0000000074C71000-memory.dmpFilesize
5.7MB
-
memory/3920-2-0x00000000746C0000-0x0000000074C71000-memory.dmpFilesize
5.7MB
-
memory/3920-17-0x00000000746C0000-0x0000000074C71000-memory.dmpFilesize
5.7MB