Analysis
- max time kernel
150s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system - submitted
15/07/2024, 17:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4abeb33f772ca93660df7daee3b54caf_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
4abeb33f772ca93660df7daee3b54caf_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 4abeb33f772ca93660df7daee3b54caf_JaffaCakes118.exe
- Size 495KB
- Sample240715-wcs13avclh
- SHA256 14f3054a0742a932e28e711e6b0a27dd98ec517a439071089d1ba9e9fb60bbc1
- MD5 4abeb33f772ca93660df7daee3b54caf
- SHA1 db9d92824dec584adc843cdbdc2acf40b33e5fb0
- SHA512 78a89bb1b77cf5af351fa76a6643b9efa1a4451ac407e5ae17232208e2baea513a04eb941f1c58029bc8113295253ec2babc73ae9b9a8d2f4bc0f0b4014f2944
- SSDEEP 6144:URjhM7r1NmtirMgt7EK99RmDAHwiuxS4PqtpUhWbiC27h4jFsRJ:qhMm1gh/TRmDPiurqtmlhQ2
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation 4abeb33f772ca93660df7daee3b54caf_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation dbghelp.exe - Executes dropped EXE 2 IoCs
pid Process 3800 dbghelp.exe 5008 libcurl.exe -
resource yara_rule behavioral2/memory/556-8-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/556-7-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/556-9-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/556-11-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/556-10-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/556-14-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/556-15-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/556-13-0x0000000000400000-0x00000000004B5000-memory.dmp upx - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\© Microsoft Real Time Media Stack = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dbghelp.exe" dbghelp.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2432 set thread context of 556 2432 4abeb33f772ca93660df7daee3b54caf_JaffaCakes118.exe 84 PID 5008 set thread context of 5112 5008 libcurl.exe 89 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2432 4abeb33f772ca93660df7daee3b54caf_JaffaCakes118.exe 3800 dbghelp.exe 5008 libcurl.exe 2432 4abeb33f772ca93660df7daee3b54caf_JaffaCakes118.exe 3800 dbghelp.exe 5008 libcurl.exe 2432 4abeb33f772ca93660df7daee3b54caf_JaffaCakes118.exe 3800 dbghelp.exe 5008 libcurl.exe 2432 4abeb33f772ca93660df7daee3b54caf_JaffaCakes118.exe 3800 dbghelp.exe 5008 libcurl.exe 2432 4abeb33f772ca93660df7daee3b54caf_JaffaCakes118.exe 3800 dbghelp.exe 5008 libcurl.exe 2432 4abeb33f772ca93660df7daee3b54caf_JaffaCakes118.exe 3800 dbghelp.exe 5008 libcurl.exe 2432 4abeb33f772ca93660df7daee3b54caf_JaffaCakes118.exe 3800 dbghelp.exe 5008 libcurl.exe 2432 4abeb33f772ca93660df7daee3b54caf_JaffaCakes118.exe 3800 dbghelp.exe 5008 libcurl.exe 2432 4abeb33f772ca93660df7daee3b54caf_JaffaCakes118.exe 3800 dbghelp.exe 5008 libcurl.exe 2432 4abeb33f772ca93660df7daee3b54caf_JaffaCakes118.exe 3800 dbghelp.exe 5008 libcurl.exe 2432 4abeb33f772ca93660df7daee3b54caf_JaffaCakes118.exe 3800 dbghelp.exe 5008 libcurl.exe 2432 4abeb33f772ca93660df7daee3b54caf_JaffaCakes118.exe 3800 dbghelp.exe 5008 libcurl.exe 2432 4abeb33f772ca93660df7daee3b54caf_JaffaCakes118.exe 3800 dbghelp.exe 5008 libcurl.exe 2432 4abeb33f772ca93660df7daee3b54caf_JaffaCakes118.exe 3800 dbghelp.exe 5008 libcurl.exe 2432 4abeb33f772ca93660df7daee3b54caf_JaffaCakes118.exe 3800 dbghelp.exe 5008 libcurl.exe 2432 4abeb33f772ca93660df7daee3b54caf_JaffaCakes118.exe 3800 dbghelp.exe 5008 libcurl.exe 2432 4abeb33f772ca93660df7daee3b54caf_JaffaCakes118.exe 3800 dbghelp.exe 5008 libcurl.exe 2432 4abeb33f772ca93660df7daee3b54caf_JaffaCakes118.exe 3800 dbghelp.exe 5008 libcurl.exe 2432 4abeb33f772ca93660df7daee3b54caf_JaffaCakes118.exe 3800 dbghelp.exe 5008 libcurl.exe 2432 4abeb33f772ca93660df7daee3b54caf_JaffaCakes118.exe 3800 dbghelp.exe 5008 libcurl.exe 2432 4abeb33f772ca93660df7daee3b54caf_JaffaCakes118.exe 3800 dbghelp.exe 5008 libcurl.exe 2432 4abeb33f772ca93660df7daee3b54caf_JaffaCakes118.exe - Suspicious use of AdjustPrivilegeToken 51 IoCs
description pid Process Token: SeDebugPrivilege 2432 4abeb33f772ca93660df7daee3b54caf_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 556 AppLaunch.exe Token: SeSecurityPrivilege 556 AppLaunch.exe Token: SeTakeOwnershipPrivilege 556 AppLaunch.exe Token: SeLoadDriverPrivilege 556 AppLaunch.exe Token: SeSystemProfilePrivilege 556 AppLaunch.exe Token: SeSystemtimePrivilege 556 AppLaunch.exe Token: SeProfSingleProcessPrivilege 556 AppLaunch.exe Token: SeIncBasePriorityPrivilege 556 AppLaunch.exe Token: SeCreatePagefilePrivilege 556 AppLaunch.exe Token: SeBackupPrivilege 556 AppLaunch.exe Token: SeRestorePrivilege 556 AppLaunch.exe Token: SeShutdownPrivilege 556 AppLaunch.exe Token: SeDebugPrivilege 556 AppLaunch.exe Token: SeSystemEnvironmentPrivilege 556 AppLaunch.exe Token: SeChangeNotifyPrivilege 556 AppLaunch.exe Token: SeRemoteShutdownPrivilege 556 AppLaunch.exe Token: SeUndockPrivilege 556 AppLaunch.exe Token: SeManageVolumePrivilege 556 AppLaunch.exe Token: SeImpersonatePrivilege 556 AppLaunch.exe Token: SeCreateGlobalPrivilege 556 AppLaunch.exe Token: 33 556 AppLaunch.exe Token: 34 556 AppLaunch.exe Token: 35 556 AppLaunch.exe Token: 36 556 AppLaunch.exe Token: SeDebugPrivilege 3800 dbghelp.exe Token: SeDebugPrivilege 5008 libcurl.exe Token: SeIncreaseQuotaPrivilege 5112 AppLaunch.exe Token: SeSecurityPrivilege 5112 AppLaunch.exe Token: SeTakeOwnershipPrivilege 5112 AppLaunch.exe Token: SeLoadDriverPrivilege 5112 AppLaunch.exe Token: SeSystemProfilePrivilege 5112 AppLaunch.exe Token: SeSystemtimePrivilege 5112 AppLaunch.exe Token: SeProfSingleProcessPrivilege 5112 AppLaunch.exe Token: SeIncBasePriorityPrivilege 5112 AppLaunch.exe Token: SeCreatePagefilePrivilege 5112 AppLaunch.exe Token: SeBackupPrivilege 5112 AppLaunch.exe Token: SeRestorePrivilege 5112 AppLaunch.exe Token: SeShutdownPrivilege 5112 AppLaunch.exe Token: SeDebugPrivilege 5112 AppLaunch.exe Token: SeSystemEnvironmentPrivilege 5112 AppLaunch.exe Token: SeChangeNotifyPrivilege 5112 AppLaunch.exe Token: SeRemoteShutdownPrivilege 5112 AppLaunch.exe Token: SeUndockPrivilege 5112 AppLaunch.exe Token: SeManageVolumePrivilege 5112 AppLaunch.exe Token: SeImpersonatePrivilege 5112 AppLaunch.exe Token: SeCreateGlobalPrivilege 5112 AppLaunch.exe Token: 33 5112 AppLaunch.exe Token: 34 5112 AppLaunch.exe Token: 35 5112 AppLaunch.exe Token: 36 5112 AppLaunch.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 556 AppLaunch.exe - Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 2432 wrote to memory of 556 2432 4abeb33f772ca93660df7daee3b54caf_JaffaCakes118.exe 84 PID 2432 wrote to memory of 556 2432 4abeb33f772ca93660df7daee3b54caf_JaffaCakes118.exe 84 PID 2432 wrote to memory of 556 2432 4abeb33f772ca93660df7daee3b54caf_JaffaCakes118.exe 84 PID 2432 wrote to memory of 556 2432 4abeb33f772ca93660df7daee3b54caf_JaffaCakes118.exe 84 PID 2432 wrote to memory of 556 2432 4abeb33f772ca93660df7daee3b54caf_JaffaCakes118.exe 84 PID 2432 wrote to memory of 556 2432 4abeb33f772ca93660df7daee3b54caf_JaffaCakes118.exe 84 PID 2432 wrote to memory of 556 2432 4abeb33f772ca93660df7daee3b54caf_JaffaCakes118.exe 84 PID 2432 wrote to memory of 556 2432 4abeb33f772ca93660df7daee3b54caf_JaffaCakes118.exe 84 PID 2432 wrote to memory of 3800 2432 4abeb33f772ca93660df7daee3b54caf_JaffaCakes118.exe 87 PID 2432 wrote to memory of 3800 2432 4abeb33f772ca93660df7daee3b54caf_JaffaCakes118.exe 87 PID 2432 wrote to memory of 3800 2432 4abeb33f772ca93660df7daee3b54caf_JaffaCakes118.exe 87 PID 3800 wrote to memory of 5008 3800 dbghelp.exe 88 PID 3800 wrote to memory of 5008 3800 dbghelp.exe 88 PID 3800 wrote to memory of 5008 3800 dbghelp.exe 88 PID 5008 wrote to memory of 5112 5008 libcurl.exe 89 PID 5008 wrote to memory of 5112 5008 libcurl.exe 89 PID 5008 wrote to memory of 5112 5008 libcurl.exe 89 PID 5008 wrote to memory of 5112 5008 libcurl.exe 89 PID 5008 wrote to memory of 5112 5008 libcurl.exe 89 PID 5008 wrote to memory of 5112 5008 libcurl.exe 89 PID 5008 wrote to memory of 5112 5008 libcurl.exe 89 PID 5008 wrote to memory of 5112 5008 libcurl.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\4abeb33f772ca93660df7daee3b54caf_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4abeb33f772ca93660df7daee3b54caf_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:556
-
-
C:\Users\Admin\AppData\Local\Temp\dbghelp.exe"C:\Users\Admin\AppData\Local\Temp\dbghelp.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\libcurl.exe"C:\Users\Admin\AppData\Local\Temp\libcurl.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:5112
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\dbghelp.exe
- Size 6KB
- SHA256 3f5c096136acc066c81b5c15feb96d04bda69d0ff3708ee80b7eb2bed70d4e34
- MD5 1a9e6acf61d24e829059f5595edab9bf
- SHA1 920090a21b02ca097a98eeec367d813276fc63ef
- SHA512 7b0a5a91c6601a67ea3627ab488e333d024a7a1852fb84d4fb5581f61ee9d9acb38f8e7e024e28e8b58533c51d7295d59f4a8e17ff3c7f5e0816423844bb1678
- SSDEEP 96:dZH4uqlGLZmcAZfgbtgkKSBCGmLW7EszNt:TgGNlAZEFiW4W
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\libcurl.exe
- Size 495KB
- SHA256 14f3054a0742a932e28e711e6b0a27dd98ec517a439071089d1ba9e9fb60bbc1
- MD5 4abeb33f772ca93660df7daee3b54caf
- SHA1 db9d92824dec584adc843cdbdc2acf40b33e5fb0
- SHA512 78a89bb1b77cf5af351fa76a6643b9efa1a4451ac407e5ae17232208e2baea513a04eb941f1c58029bc8113295253ec2babc73ae9b9a8d2f4bc0f0b4014f2944
- SSDEEP 6144:URjhM7r1NmtirMgt7EK99RmDAHwiuxS4PqtpUhWbiC27h4jFsRJ:qhMm1gh/TRmDPiurqtmlhQ2
- MD5 SHA1 SHA512 SSDEEP