Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
03-07-2024 07:57
Static task
static1
Behavioral task
behavioral1
Sample
219d5dd95e4c69f07bac60975696d3a8_JaffaCakes118.exe
Resource
win7-20240508-en
General
-
Target
219d5dd95e4c69f07bac60975696d3a8_JaffaCakes118.exe
-
Size
59KB
-
MD5
219d5dd95e4c69f07bac60975696d3a8
-
SHA1
dc19d95cdce0ec461977545e99cb3c54d4d00778
-
SHA256
e20d34a3d3d09fa050e8c13adc532aa8e7d7b43f01822a5af915b20acb59d29d
-
SHA512
018c084573384516da9ed61ac335c899a2634c4f42ea10a414ee1068a6eee1e8febc36c5434e261335db852d250b84ec37d3a34664e95102e72671c58cd1f20c
-
SSDEEP
768:n5mhew0GpSyMe6hwUkdwJzh+qciaQRENEzxZbARtR06g2wqp4YPeznellmqGwxPl:nK0GjMeQG3iaQREuVZ6ro29p4YxbKdA
Malware Config
Extracted
urelas
218.54.47.76
218.54.47.77
218.54.47.74
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
219d5dd95e4c69f07bac60975696d3a8_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 219d5dd95e4c69f07bac60975696d3a8_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
Processes:
biudfw.exepid process 4784 biudfw.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
219d5dd95e4c69f07bac60975696d3a8_JaffaCakes118.exedescription pid process target process PID 4660 wrote to memory of 4784 4660 219d5dd95e4c69f07bac60975696d3a8_JaffaCakes118.exe biudfw.exe PID 4660 wrote to memory of 4784 4660 219d5dd95e4c69f07bac60975696d3a8_JaffaCakes118.exe biudfw.exe PID 4660 wrote to memory of 4784 4660 219d5dd95e4c69f07bac60975696d3a8_JaffaCakes118.exe biudfw.exe PID 4660 wrote to memory of 2920 4660 219d5dd95e4c69f07bac60975696d3a8_JaffaCakes118.exe cmd.exe PID 4660 wrote to memory of 2920 4660 219d5dd95e4c69f07bac60975696d3a8_JaffaCakes118.exe cmd.exe PID 4660 wrote to memory of 2920 4660 219d5dd95e4c69f07bac60975696d3a8_JaffaCakes118.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\219d5dd95e4c69f07bac60975696d3a8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\219d5dd95e4c69f07bac60975696d3a8_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\biudfw.exe"C:\Users\Admin\AppData\Local\Temp\biudfw.exe"2⤵
- Executes dropped EXE
PID:4784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "2⤵PID:2920
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\biudfw.exeFilesize
59KB
MD5008877570b3f6e0b88b308fc8942a5ea
SHA1409db8cc8e0a6d8130c0ae9bf779a2bfd7f9d654
SHA2564306d0e3879b0f63bdf5b09befa2c697bd203ebc0ff66e61593db9a71b94c890
SHA51295105072e56f39ad10ce6fce2d994ddf41b8a533b827472a38a34f2688363c37f3238c184911fb06249f6be40c274b2184a91da08643914bfb1feae2a8d7ceb1
-
C:\Users\Admin\AppData\Local\Temp\golfinfo.iniFilesize
512B
MD555e10a9af74d3f3fa5ae3cb7ff5ad9d4
SHA1449221fd8d7196a54de2bd583625d8d1b64db56a
SHA256a945a44cfe50423c01f26a16445ed177a347052e791364a9cb7de6bcaa18f3c1
SHA5124af5ba74467b4c61302ea9571f19346c05f911843f2c6153fcd9a7340f9bc6e1f8867cdb72ec7ba0dc4930199aa5c302711ad5da9fd35241839418f6e70a515a
-
C:\Users\Admin\AppData\Local\Temp\sanfdr.batFilesize
302B
MD5e5ec0d39ff9bb19977a720e417641d5e
SHA101a365a98069810ab2dce5acf9cf5514eec17ee4
SHA2566a30e3389d18e862fe2f98a26f528746de496350884c15099a15cbdfd6275260
SHA512b6be62d035975a800f9ddb9915120ec77668cc587ddcc15420b92882fd8a49fa629ae99b183057d781b0d41996bfb427109634089fb69cffb49e5005ff4af2a8
-
memory/4660-0-0x0000000000C00000-0x0000000000C35000-memory.dmpFilesize
212KB
-
memory/4660-15-0x0000000000C00000-0x0000000000C35000-memory.dmpFilesize
212KB
-
memory/4784-12-0x0000000000BD0000-0x0000000000C05000-memory.dmpFilesize
212KB
-
memory/4784-18-0x0000000000BD0000-0x0000000000C05000-memory.dmpFilesize
212KB
-
memory/4784-20-0x0000000000BD0000-0x0000000000C05000-memory.dmpFilesize
212KB
-
memory/4784-27-0x0000000000BD0000-0x0000000000C05000-memory.dmpFilesize
212KB