Analysis
-
max time kernel
149s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
04-07-2024 09:51
Behavioral task
behavioral1
Sample
25828a49aefdc4c99228780bbd5e14f9_JaffaCakes118.exe
Resource
win7-20240419-en
General
-
Target
25828a49aefdc4c99228780bbd5e14f9_JaffaCakes118.exe
-
Size
463KB
-
MD5
25828a49aefdc4c99228780bbd5e14f9
-
SHA1
d06a93c5c456d28f03eb195813680f293740a164
-
SHA256
4dc3dd538d21ee16d64e9afe747ecc29ba511bd42bf22dd29d592348d4cd731a
-
SHA512
b4e795d59f2e849ecb80f35b1225e3c9c81bbfaf6866b77bf43eae19e0f16784db06e00705ee6852741e925a17345d293389e9b7566725fe02978f70e476cca2
-
SSDEEP
12288:Y6twjLHj/8/GcHUIdPPzEmvTnabAh0ZnAr1Uv:Y6tQCG0UUPzEkTn4AC1+s
Malware Config
Extracted
urelas
1.234.83.146
133.242.129.155
218.54.31.226
218.54.30.235
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
25828a49aefdc4c99228780bbd5e14f9_JaffaCakes118.exetokus.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 25828a49aefdc4c99228780bbd5e14f9_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation tokus.exe -
Executes dropped EXE 2 IoCs
Processes:
tokus.exesomae.exepid process 3780 tokus.exe 1528 somae.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\somae.exe upx behavioral2/memory/1528-26-0x0000000000400000-0x000000000049F000-memory.dmp upx behavioral2/memory/1528-28-0x0000000000400000-0x000000000049F000-memory.dmp upx behavioral2/memory/1528-29-0x0000000000400000-0x000000000049F000-memory.dmp upx behavioral2/memory/1528-30-0x0000000000400000-0x000000000049F000-memory.dmp upx behavioral2/memory/1528-31-0x0000000000400000-0x000000000049F000-memory.dmp upx behavioral2/memory/1528-32-0x0000000000400000-0x000000000049F000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
somae.exepid process 1528 somae.exe 1528 somae.exe 1528 somae.exe 1528 somae.exe 1528 somae.exe 1528 somae.exe 1528 somae.exe 1528 somae.exe 1528 somae.exe 1528 somae.exe 1528 somae.exe 1528 somae.exe 1528 somae.exe 1528 somae.exe 1528 somae.exe 1528 somae.exe 1528 somae.exe 1528 somae.exe 1528 somae.exe 1528 somae.exe 1528 somae.exe 1528 somae.exe 1528 somae.exe 1528 somae.exe 1528 somae.exe 1528 somae.exe 1528 somae.exe 1528 somae.exe 1528 somae.exe 1528 somae.exe 1528 somae.exe 1528 somae.exe 1528 somae.exe 1528 somae.exe 1528 somae.exe 1528 somae.exe 1528 somae.exe 1528 somae.exe 1528 somae.exe 1528 somae.exe 1528 somae.exe 1528 somae.exe 1528 somae.exe 1528 somae.exe 1528 somae.exe 1528 somae.exe 1528 somae.exe 1528 somae.exe 1528 somae.exe 1528 somae.exe 1528 somae.exe 1528 somae.exe 1528 somae.exe 1528 somae.exe 1528 somae.exe 1528 somae.exe 1528 somae.exe 1528 somae.exe 1528 somae.exe 1528 somae.exe 1528 somae.exe 1528 somae.exe 1528 somae.exe 1528 somae.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
25828a49aefdc4c99228780bbd5e14f9_JaffaCakes118.exetokus.exedescription pid process target process PID 2472 wrote to memory of 3780 2472 25828a49aefdc4c99228780bbd5e14f9_JaffaCakes118.exe tokus.exe PID 2472 wrote to memory of 3780 2472 25828a49aefdc4c99228780bbd5e14f9_JaffaCakes118.exe tokus.exe PID 2472 wrote to memory of 3780 2472 25828a49aefdc4c99228780bbd5e14f9_JaffaCakes118.exe tokus.exe PID 2472 wrote to memory of 3116 2472 25828a49aefdc4c99228780bbd5e14f9_JaffaCakes118.exe cmd.exe PID 2472 wrote to memory of 3116 2472 25828a49aefdc4c99228780bbd5e14f9_JaffaCakes118.exe cmd.exe PID 2472 wrote to memory of 3116 2472 25828a49aefdc4c99228780bbd5e14f9_JaffaCakes118.exe cmd.exe PID 3780 wrote to memory of 1528 3780 tokus.exe somae.exe PID 3780 wrote to memory of 1528 3780 tokus.exe somae.exe PID 3780 wrote to memory of 1528 3780 tokus.exe somae.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\25828a49aefdc4c99228780bbd5e14f9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\25828a49aefdc4c99228780bbd5e14f9_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\tokus.exe"C:\Users\Admin\AppData\Local\Temp\tokus.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\somae.exe"C:\Users\Admin\AppData\Local\Temp\somae.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_sannuy.bat" "2⤵PID:3116
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\_sannuy.batFilesize
304B
MD57edb286b06ca861b92f296edf88f90f5
SHA17e1fc2fe2687296ef7fc4ef130c12160c0964422
SHA256c7a81e8d67509291e3cc1fa90a31cc445d7eb1f032278b502239f8745822b8a0
SHA51245077ce066512aa8447cd5a589979ffb5cd9e66c08edc278cfc86e1b1b56d7bec8422f3b24a52e34561252b19c484ed59159dae07b6cf1ee3e2fab5e3887b49a
-
C:\Users\Admin\AppData\Local\Temp\golfinfo.iniFilesize
512B
MD5faf27c2513a6d26dbb329e959f184896
SHA16f72b9f2cf13e0febf807ba7d3b30313bab1d073
SHA256aa6687dc55abaf159c374f9ef9d2645ad15f0f57c150e880ef0cac48dbb9cb6f
SHA512c1030d528074f2ca25b57b88eaa31d56de8fb9065de1a823c64e301fab429220d2537c978b7076974e35e9654f10e5dfb53169a3682320f39038aa1edd96734b
-
C:\Users\Admin\AppData\Local\Temp\somae.exeFilesize
198KB
MD589c29b27968f3c44fbeb2e04892f937d
SHA13b4b3f7043b8bb57509e77c9572f2ef3ce464dd7
SHA256d1cde2943dd9f1cff17b1e5b9ad0eb1faa671c5bb9417753d7ef39a4042db688
SHA512844ea8f5320771f2435d47ea5b59a48f239538525889047744987a79f20198377b78ef09655722996ca568ec2d31d2f524cd7d6d19116e005c245021e99eb80b
-
C:\Users\Admin\AppData\Local\Temp\tokus.exeFilesize
463KB
MD517d18aa4587b807688e42658ad61db17
SHA1e2aa2461d137676d1cd7ecdc0b59cb03deb69c86
SHA25689961a79ff573e96fd6f992defebc8f9c2c091b41cfe2b0c1584f007c2de498a
SHA5129d1c5692f052c4d318f944b70fbc3ffce17b62e4a39dde491a3971d48282575c5cf5923e53dfae49ee089fff67754ef0ffd78429c0bd0e6c23d9ffad8f424e7d
-
memory/1528-28-0x0000000000400000-0x000000000049F000-memory.dmpFilesize
636KB
-
memory/1528-26-0x0000000000400000-0x000000000049F000-memory.dmpFilesize
636KB
-
memory/1528-29-0x0000000000400000-0x000000000049F000-memory.dmpFilesize
636KB
-
memory/1528-30-0x0000000000400000-0x000000000049F000-memory.dmpFilesize
636KB
-
memory/1528-31-0x0000000000400000-0x000000000049F000-memory.dmpFilesize
636KB
-
memory/1528-32-0x0000000000400000-0x000000000049F000-memory.dmpFilesize
636KB
-
memory/2472-14-0x00000000000D0000-0x000000000014C000-memory.dmpFilesize
496KB
-
memory/2472-0-0x00000000000D0000-0x000000000014C000-memory.dmpFilesize
496KB
-
memory/3780-12-0x0000000000DE0000-0x0000000000E5C000-memory.dmpFilesize
496KB
-
memory/3780-25-0x0000000000DE0000-0x0000000000E5C000-memory.dmpFilesize
496KB