Analysis
-
max time kernel
138s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
19-07-2024 04:18
Static task
static1
Behavioral task
behavioral1
Sample
5a6f1e62b8443543418fe946cc21951c_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
5a6f1e62b8443543418fe946cc21951c_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5a6f1e62b8443543418fe946cc21951c_JaffaCakes118.exe
-
Size
255KB
-
MD5
5a6f1e62b8443543418fe946cc21951c
-
SHA1
4bb3dc57fd0dda3e85c3f156142d8670777336c5
-
SHA256
231eebbfeac8480860af0aa2e57c275bf2c1e7fa26288fb1424cbbc9e261e69f
-
SHA512
e11fe0aa39137381a877c908b27b5bab0a0421109526462dffbd84b81c9ba47a756677e77d1e0ebf1555e407598d1205a006080174efb783606e5977fe8a92d8
-
SSDEEP
6144:csGUGKYxh+tcgagqz1YXoZcNYXoZcNYXoZcNYX:LGUGdh+tcgbqz1YXoZcNYXoZcNYXoZca
Malware Config
Extracted
tofsee
31.210.119.2
188.165.132.183
rgtryhbgddtyh.biz
wertdghbyrukl.ch
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
5a6f1e62b8443543418fe946cc21951c_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation 5a6f1e62b8443543418fe946cc21951c_JaffaCakes118.exe -
Executes dropped EXE 2 IoCs
Processes:
jjxgypg.exejjxgypg.exepid process 1028 jjxgypg.exe 1352 jjxgypg.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
5a6f1e62b8443543418fe946cc21951c_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSConfig = "\"C:\\Users\\Admin\\jjxgypg.exe\" /r" 5a6f1e62b8443543418fe946cc21951c_JaffaCakes118.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
5a6f1e62b8443543418fe946cc21951c_JaffaCakes118.exejjxgypg.exejjxgypg.exedescription pid process target process PID 5064 set thread context of 3696 5064 5a6f1e62b8443543418fe946cc21951c_JaffaCakes118.exe 5a6f1e62b8443543418fe946cc21951c_JaffaCakes118.exe PID 1028 set thread context of 1352 1028 jjxgypg.exe jjxgypg.exe PID 1352 set thread context of 1380 1352 jjxgypg.exe svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4656 1380 WerFault.exe svchost.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
5a6f1e62b8443543418fe946cc21951c_JaffaCakes118.exe5a6f1e62b8443543418fe946cc21951c_JaffaCakes118.exejjxgypg.exejjxgypg.exedescription pid process target process PID 5064 wrote to memory of 3696 5064 5a6f1e62b8443543418fe946cc21951c_JaffaCakes118.exe 5a6f1e62b8443543418fe946cc21951c_JaffaCakes118.exe PID 5064 wrote to memory of 3696 5064 5a6f1e62b8443543418fe946cc21951c_JaffaCakes118.exe 5a6f1e62b8443543418fe946cc21951c_JaffaCakes118.exe PID 5064 wrote to memory of 3696 5064 5a6f1e62b8443543418fe946cc21951c_JaffaCakes118.exe 5a6f1e62b8443543418fe946cc21951c_JaffaCakes118.exe PID 5064 wrote to memory of 3696 5064 5a6f1e62b8443543418fe946cc21951c_JaffaCakes118.exe 5a6f1e62b8443543418fe946cc21951c_JaffaCakes118.exe PID 5064 wrote to memory of 3696 5064 5a6f1e62b8443543418fe946cc21951c_JaffaCakes118.exe 5a6f1e62b8443543418fe946cc21951c_JaffaCakes118.exe PID 5064 wrote to memory of 3696 5064 5a6f1e62b8443543418fe946cc21951c_JaffaCakes118.exe 5a6f1e62b8443543418fe946cc21951c_JaffaCakes118.exe PID 5064 wrote to memory of 3696 5064 5a6f1e62b8443543418fe946cc21951c_JaffaCakes118.exe 5a6f1e62b8443543418fe946cc21951c_JaffaCakes118.exe PID 5064 wrote to memory of 3696 5064 5a6f1e62b8443543418fe946cc21951c_JaffaCakes118.exe 5a6f1e62b8443543418fe946cc21951c_JaffaCakes118.exe PID 5064 wrote to memory of 3696 5064 5a6f1e62b8443543418fe946cc21951c_JaffaCakes118.exe 5a6f1e62b8443543418fe946cc21951c_JaffaCakes118.exe PID 3696 wrote to memory of 1028 3696 5a6f1e62b8443543418fe946cc21951c_JaffaCakes118.exe jjxgypg.exe PID 3696 wrote to memory of 1028 3696 5a6f1e62b8443543418fe946cc21951c_JaffaCakes118.exe jjxgypg.exe PID 3696 wrote to memory of 1028 3696 5a6f1e62b8443543418fe946cc21951c_JaffaCakes118.exe jjxgypg.exe PID 3696 wrote to memory of 4312 3696 5a6f1e62b8443543418fe946cc21951c_JaffaCakes118.exe cmd.exe PID 3696 wrote to memory of 4312 3696 5a6f1e62b8443543418fe946cc21951c_JaffaCakes118.exe cmd.exe PID 3696 wrote to memory of 4312 3696 5a6f1e62b8443543418fe946cc21951c_JaffaCakes118.exe cmd.exe PID 1028 wrote to memory of 1352 1028 jjxgypg.exe jjxgypg.exe PID 1028 wrote to memory of 1352 1028 jjxgypg.exe jjxgypg.exe PID 1028 wrote to memory of 1352 1028 jjxgypg.exe jjxgypg.exe PID 1028 wrote to memory of 1352 1028 jjxgypg.exe jjxgypg.exe PID 1028 wrote to memory of 1352 1028 jjxgypg.exe jjxgypg.exe PID 1028 wrote to memory of 1352 1028 jjxgypg.exe jjxgypg.exe PID 1028 wrote to memory of 1352 1028 jjxgypg.exe jjxgypg.exe PID 1028 wrote to memory of 1352 1028 jjxgypg.exe jjxgypg.exe PID 1028 wrote to memory of 1352 1028 jjxgypg.exe jjxgypg.exe PID 1352 wrote to memory of 1380 1352 jjxgypg.exe svchost.exe PID 1352 wrote to memory of 1380 1352 jjxgypg.exe svchost.exe PID 1352 wrote to memory of 1380 1352 jjxgypg.exe svchost.exe PID 1352 wrote to memory of 1380 1352 jjxgypg.exe svchost.exe PID 1352 wrote to memory of 1380 1352 jjxgypg.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a6f1e62b8443543418fe946cc21951c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5a6f1e62b8443543418fe946cc21951c_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\5a6f1e62b8443543418fe946cc21951c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5a6f1e62b8443543418fe946cc21951c_JaffaCakes118.exe"2⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Users\Admin\jjxgypg.exe"C:\Users\Admin\jjxgypg.exe" /r3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Users\Admin\jjxgypg.exe"C:\Users\Admin\jjxgypg.exe" /r4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Windows\SysWOW64\svchost.exesvchost.exe5⤵PID:1380
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1380 -s 3246⤵
- Program crash
PID:4656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7471.bat" "3⤵PID:4312
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1380 -ip 13801⤵PID:896
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7471.batFilesize
117B
MD5900e98af12c059c9874f589baacd5ead
SHA19ca5db7f48bf3c94cfeb46afa65d6bc307fdb762
SHA25631fb27714f89685e0c73fc168c36132175e7ef372e2e5cd259474ca1d63d615d
SHA512d13be4df50ef1c4f6a3b40409342e232d7965ac9328cdf305909959cf9687bbadb63903048f47f17735fc37d221b432fbe90aa6da6b442ccbf37850c185d4cd9
-
C:\Users\Admin\jjxgypg.exeFilesize
255KB
MD55a6f1e62b8443543418fe946cc21951c
SHA14bb3dc57fd0dda3e85c3f156142d8670777336c5
SHA256231eebbfeac8480860af0aa2e57c275bf2c1e7fa26288fb1424cbbc9e261e69f
SHA512e11fe0aa39137381a877c908b27b5bab0a0421109526462dffbd84b81c9ba47a756677e77d1e0ebf1555e407598d1205a006080174efb783606e5977fe8a92d8
-
memory/1352-19-0x0000000000400000-0x0000000000436000-memory.dmpFilesize
216KB
-
memory/1380-29-0x0000000000400000-0x0000000000436000-memory.dmpFilesize
216KB
-
memory/1380-30-0x00000000005B0000-0x00000000005B1000-memory.dmpFilesize
4KB
-
memory/1380-31-0x0000000000400000-0x0000000000436000-memory.dmpFilesize
216KB
-
memory/1380-32-0x0000000000400000-0x0000000000436000-memory.dmpFilesize
216KB
-
memory/3696-0-0x0000000000400000-0x0000000000436000-memory.dmpFilesize
216KB
-
memory/3696-2-0x0000000000400000-0x0000000000436000-memory.dmpFilesize
216KB
-
memory/3696-4-0x0000000000400000-0x0000000000436000-memory.dmpFilesize
216KB
-
memory/3696-13-0x0000000000400000-0x0000000000436000-memory.dmpFilesize
216KB