Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
10/07/2024, 12:44
Static task
static1
Behavioral task
behavioral1
Sample
34c6c16ff04a6e3f21258e591aa36b1d_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
34c6c16ff04a6e3f21258e591aa36b1d_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
34c6c16ff04a6e3f21258e591aa36b1d_JaffaCakes118.exe
-
Size
217KB
-
MD5
34c6c16ff04a6e3f21258e591aa36b1d
-
SHA1
666e6c5f30c76891ec02e5616a3dc53c30ccfd30
-
SHA256
f62250be625fa9c7ba1d7f31cf3f4e2f723a8c32a056a6eeef8f15360619e4b2
-
SHA512
fdb7446a96c67a366271f0154aad2c9a7c1eb901f583f92c643bb5c5823bcdfe02c8c4a84d66ee0941a83a6968d66faf041b163f58f90818a677d5cf159bacb3
-
SSDEEP
3072:1gRYSzZ+518CpxoPL7nYqQ8Xx0BpFJti4VPCr3WHYvGE8a0A+te:6/vCp6TrYqQ8XOBpzbYgYX8a0E
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation 34c6c16ff04a6e3f21258e591aa36b1d_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation explore.exe -
Executes dropped EXE 2 IoCs
pid Process 2812 explore.exe 3032 winlog.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlog.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\winlog.exe" winlog.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explore.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2168 wrote to memory of 2812 2168 34c6c16ff04a6e3f21258e591aa36b1d_JaffaCakes118.exe 85 PID 2168 wrote to memory of 2812 2168 34c6c16ff04a6e3f21258e591aa36b1d_JaffaCakes118.exe 85 PID 2168 wrote to memory of 2812 2168 34c6c16ff04a6e3f21258e591aa36b1d_JaffaCakes118.exe 85 PID 2812 wrote to memory of 3032 2812 explore.exe 86 PID 2812 wrote to memory of 3032 2812 explore.exe 86 PID 2812 wrote to memory of 3032 2812 explore.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\34c6c16ff04a6e3f21258e591aa36b1d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\34c6c16ff04a6e3f21258e591aa36b1d_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\explore.exe"C:\Users\Admin\AppData\Local\Temp\explore.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Roaming\Microsoft\winlog.exe"C:\Users\Admin\AppData\Roaming\Microsoft\winlog.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
PID:3032
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
141KB
MD547ecfdf73d15deaeef79e13a16afdd29
SHA16bb2355e596b525d25c18917fab6ca12df2b583e
SHA256d9cf0badf82a33c8e5c723ef6be77febc7db79955a411383a1b7ba3ffcd1af6c
SHA512dd22a14d80a8563748c0de543df1e119ef7566a6b5be40e081d4505dfc213555268b93bf028f1557679f7200b3ff7f95dd557a44b283165e5366e33f7ac9581b