Analysis
-
max time kernel
149s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
15/07/2024, 03:15
Static task
static1
Behavioral task
behavioral1
Sample
47fab2748dfbb8faea929ab898951bbc_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral2
Sample
47fab2748dfbb8faea929ab898951bbc_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
General
-
Target
47fab2748dfbb8faea929ab898951bbc_JaffaCakes118.exe
-
Size
1.8MB
-
MD5
47fab2748dfbb8faea929ab898951bbc
-
SHA1
1f014edb0c69555bbbc374f83959b9e8d16288c3
-
SHA256
cfcd7448244868ae81f1c2d20ccf0287d6ec530d518a56d88f5f621fea77f590
-
SHA512
5d5fee03e9e775ab12337d3c6db6b13fc20d1be8e365adcde83397f3dd02489bee2a9ea4205ba5edf3f17e1275414eaa10f7913f7b52c01bb5342838b8f9bc99
-
SSDEEP
49152:W7wSSXQxj0oIvzN2nSrItK09LBUcqYiNs0nkY:WMS0YRkzNDYnqNBkY
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation install.exe Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation isass.exe Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation 47fab2748dfbb8faea929ab898951bbc_JaffaCakes118.exe -
Executes dropped EXE 3 IoCs
pid Process 4824 install.exe 3908 isass.exe 4592 torrentkapat.exe -
Loads dropped DLL 4 IoCs
pid Process 3908 isass.exe 3908 isass.exe 4592 torrentkapat.exe 4592 torrentkapat.exe -
resource yara_rule behavioral2/files/0x00070000000234ce-37.dat upx behavioral2/memory/4592-38-0x0000000000400000-0x00000000004B8000-memory.dmp upx behavioral2/memory/4592-47-0x0000000000400000-0x00000000004B8000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Users\\Admin\\AppData\\Local\\isass.exe \"" reg.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/4592-47-0x0000000000400000-0x00000000004B8000-memory.dmp autoit_exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 1 IoCs
pid Process 4472 reg.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 4824 install.exe 4824 install.exe 4824 install.exe 4824 install.exe 4824 install.exe 4824 install.exe 4824 install.exe 4824 install.exe 4824 install.exe 4824 install.exe 4824 install.exe 4824 install.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4592 torrentkapat.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe 4592 torrentkapat.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3908 isass.exe 4592 torrentkapat.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 2736 wrote to memory of 4824 2736 47fab2748dfbb8faea929ab898951bbc_JaffaCakes118.exe 86 PID 2736 wrote to memory of 4824 2736 47fab2748dfbb8faea929ab898951bbc_JaffaCakes118.exe 86 PID 2736 wrote to memory of 4824 2736 47fab2748dfbb8faea929ab898951bbc_JaffaCakes118.exe 86 PID 4824 wrote to memory of 3908 4824 install.exe 87 PID 4824 wrote to memory of 3908 4824 install.exe 87 PID 4824 wrote to memory of 3908 4824 install.exe 87 PID 4824 wrote to memory of 4592 4824 install.exe 88 PID 4824 wrote to memory of 4592 4824 install.exe 88 PID 4824 wrote to memory of 4592 4824 install.exe 88 PID 3908 wrote to memory of 4224 3908 isass.exe 89 PID 3908 wrote to memory of 4224 3908 isass.exe 89 PID 3908 wrote to memory of 4224 3908 isass.exe 89 PID 4224 wrote to memory of 2876 4224 cmd.exe 91 PID 4224 wrote to memory of 2876 4224 cmd.exe 91 PID 4224 wrote to memory of 2876 4224 cmd.exe 91 PID 2876 wrote to memory of 4472 2876 cmd.exe 92 PID 2876 wrote to memory of 4472 2876 cmd.exe 92 PID 2876 wrote to memory of 4472 2876 cmd.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\47fab2748dfbb8faea929ab898951bbc_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\47fab2748dfbb8faea929ab898951bbc_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\install.exe"C:\Users\Admin\AppData\Local\Temp\install.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Users\Admin\AppData\Local\isass.exe"C:\Users\Admin\AppData\Local\isass.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\setup.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /V lsass /D "\"C:\Users\Admin\AppData\Local\isass.exe \"" /f5⤵
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Windows\SysWOW64\reg.exeREG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /V lsass /D "\"C:\Users\Admin\AppData\Local\isass.exe \"" /f6⤵
- Adds Run key to start application
- Modifies registry key
PID:4472
-
-
-
-
-
C:\Users\Admin\AppData\Local\torrentkapat.exe"C:\Users\Admin\AppData\Local\torrentkapat.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4592
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD58668d949eeef74b59a15e234dc767d09
SHA15932a9c75f4dc5cd281db6cbba90b637c28b806d
SHA256ca16b494db981b5e7cb2459fa0cceae0fb714954446347ee6b4e116afab40709
SHA5128e3f6f2a820ff51a51cec164acdee0e635ec97d7cb1a12a04f58b70677ff33fbf952d8ebcac7092f875e7e9292cbfcd54d3f08e5966bf954cc4e6d477bd33dec
-
Filesize
143B
MD5330d9a81f808b287b999c76c1d932ed6
SHA195146f6f084c39395e2fae892af065e85fddb8d1
SHA2564e2ba5afae8aedfb7664f479ff30667dbabee99f63c922206df98ff56456a03f
SHA5124abd3d3c6b40ae046366604fdfabdc2c97a54cd4c4046452014fb1087353d216b2920650cc2d147fd6c1a79fd7d73d7cd46a8ada0a5c70de70b87b480034e812
-
Filesize
540KB
MD558474427326df74ee9a3df4a1cd3ee5b
SHA1f15c9f8b4c2879741473148b201d4ededac9ccaa
SHA2568e1336697f483b08d6035e2d74e5bd8cbb0f9448ebda09138babb59f10846ebb
SHA512655243c329d4bfe7625e1f03667ec6c03ca715d30522fe0e5553986735ec0fa4273ec75535ccad515d52964bb49c0e151698d98df6420ce666f60337e1731611
-
Filesize
186KB
MD53b3f633865e78b077471b52a8e08c7ae
SHA149867697fe9f6dd2025ec2081e0c8606257e008a
SHA25676230baac105470e82f2fdedc13865d9f46c7349ffcc66e239b95893ea433fd4
SHA51277b9d6eaf413ecb24d552fbe7985ed6d277123eee1b4294db0dc52d5bc396de9c445dc53254f964dfe0ade21e2c54cba17ac6e3008c6935387fbd3e8f1442a1b
-
Filesize
286KB
MD5147f3508b03d717b6b16ad234779b5fa
SHA1abebca45c4f1feb3219f4216b1a487cee08af7aa
SHA256d560fe62c7b7cf5afc50168dd0906e170ee961e7db5fd7c382fb9d1a5d75241d
SHA5123846d5ce3ef956b941c42b5e738776535d1b91ca223ebcd98ea03705f4c2c33034dd9b011e3959392bde151c63a185aca9d6caffaee667d342fcea78a23cde08