Analysis
-
max time kernel
140s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
20/07/2024, 05:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5f3283334f76bad1f60f28f29a59fd43_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
5f3283334f76bad1f60f28f29a59fd43_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
5f3283334f76bad1f60f28f29a59fd43_JaffaCakes118.exe
-
Size
129KB
-
MD5
5f3283334f76bad1f60f28f29a59fd43
-
SHA1
4b491e84bda602c3f907608285130c6148683357
-
SHA256
b74b4376c4ddec0dda13b4cbfbe4713c7e3a30e05cf3223503ed29efe78a17a9
-
SHA512
4fd584159a1592adf04d15d04f77ed89f2918a5d4201a05a7b132d260bb3dc7fb713a33b5214e7751743780d430da90f894eb3e38813a345e6e4368eea0cd0ea
-
SSDEEP
3072:l/PqsKB4yHPQ5HgSYUHJaOu0bgMRDb1DIF:lCBRP0H/laf0bHDb10F
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Control Panel\International\Geo\Nation 5f3283334f76bad1f60f28f29a59fd43_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Control Panel\International\Geo\Nation Install_Flash_Player.exe -
Executes dropped EXE 2 IoCs
pid Process 1088 bzcheom.exe 3676 Install_Flash_Player.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 3 IoCs
pid pid_target Process procid_target 3460 4588 WerFault.exe 83 4348 1088 WerFault.exe 90 1768 3676 WerFault.exe 98 -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 2220 ipconfig.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4588 5f3283334f76bad1f60f28f29a59fd43_JaffaCakes118.exe 4588 5f3283334f76bad1f60f28f29a59fd43_JaffaCakes118.exe 4588 5f3283334f76bad1f60f28f29a59fd43_JaffaCakes118.exe 4588 5f3283334f76bad1f60f28f29a59fd43_JaffaCakes118.exe 4588 5f3283334f76bad1f60f28f29a59fd43_JaffaCakes118.exe 4588 5f3283334f76bad1f60f28f29a59fd43_JaffaCakes118.exe 4588 5f3283334f76bad1f60f28f29a59fd43_JaffaCakes118.exe 4588 5f3283334f76bad1f60f28f29a59fd43_JaffaCakes118.exe 4588 5f3283334f76bad1f60f28f29a59fd43_JaffaCakes118.exe 4588 5f3283334f76bad1f60f28f29a59fd43_JaffaCakes118.exe 4588 5f3283334f76bad1f60f28f29a59fd43_JaffaCakes118.exe 4588 5f3283334f76bad1f60f28f29a59fd43_JaffaCakes118.exe 4588 5f3283334f76bad1f60f28f29a59fd43_JaffaCakes118.exe 4588 5f3283334f76bad1f60f28f29a59fd43_JaffaCakes118.exe 4588 5f3283334f76bad1f60f28f29a59fd43_JaffaCakes118.exe 4588 5f3283334f76bad1f60f28f29a59fd43_JaffaCakes118.exe 4588 5f3283334f76bad1f60f28f29a59fd43_JaffaCakes118.exe 4588 5f3283334f76bad1f60f28f29a59fd43_JaffaCakes118.exe 4588 5f3283334f76bad1f60f28f29a59fd43_JaffaCakes118.exe 4588 5f3283334f76bad1f60f28f29a59fd43_JaffaCakes118.exe 4588 5f3283334f76bad1f60f28f29a59fd43_JaffaCakes118.exe 4588 5f3283334f76bad1f60f28f29a59fd43_JaffaCakes118.exe 4588 5f3283334f76bad1f60f28f29a59fd43_JaffaCakes118.exe 4588 5f3283334f76bad1f60f28f29a59fd43_JaffaCakes118.exe 4588 5f3283334f76bad1f60f28f29a59fd43_JaffaCakes118.exe 4588 5f3283334f76bad1f60f28f29a59fd43_JaffaCakes118.exe 4588 5f3283334f76bad1f60f28f29a59fd43_JaffaCakes118.exe 4588 5f3283334f76bad1f60f28f29a59fd43_JaffaCakes118.exe 4588 5f3283334f76bad1f60f28f29a59fd43_JaffaCakes118.exe 4588 5f3283334f76bad1f60f28f29a59fd43_JaffaCakes118.exe 4588 5f3283334f76bad1f60f28f29a59fd43_JaffaCakes118.exe 4588 5f3283334f76bad1f60f28f29a59fd43_JaffaCakes118.exe 4588 5f3283334f76bad1f60f28f29a59fd43_JaffaCakes118.exe 4588 5f3283334f76bad1f60f28f29a59fd43_JaffaCakes118.exe 4588 5f3283334f76bad1f60f28f29a59fd43_JaffaCakes118.exe 4588 5f3283334f76bad1f60f28f29a59fd43_JaffaCakes118.exe 4588 5f3283334f76bad1f60f28f29a59fd43_JaffaCakes118.exe 4588 5f3283334f76bad1f60f28f29a59fd43_JaffaCakes118.exe 4588 5f3283334f76bad1f60f28f29a59fd43_JaffaCakes118.exe 4588 5f3283334f76bad1f60f28f29a59fd43_JaffaCakes118.exe 4588 5f3283334f76bad1f60f28f29a59fd43_JaffaCakes118.exe 4588 5f3283334f76bad1f60f28f29a59fd43_JaffaCakes118.exe 4588 5f3283334f76bad1f60f28f29a59fd43_JaffaCakes118.exe 4588 5f3283334f76bad1f60f28f29a59fd43_JaffaCakes118.exe 4588 5f3283334f76bad1f60f28f29a59fd43_JaffaCakes118.exe 4588 5f3283334f76bad1f60f28f29a59fd43_JaffaCakes118.exe 4588 5f3283334f76bad1f60f28f29a59fd43_JaffaCakes118.exe 4588 5f3283334f76bad1f60f28f29a59fd43_JaffaCakes118.exe 4588 5f3283334f76bad1f60f28f29a59fd43_JaffaCakes118.exe 4588 5f3283334f76bad1f60f28f29a59fd43_JaffaCakes118.exe 4588 5f3283334f76bad1f60f28f29a59fd43_JaffaCakes118.exe 4588 5f3283334f76bad1f60f28f29a59fd43_JaffaCakes118.exe 1088 bzcheom.exe 1088 bzcheom.exe 1088 bzcheom.exe 1088 bzcheom.exe 1088 bzcheom.exe 1088 bzcheom.exe 1088 bzcheom.exe 1088 bzcheom.exe 1088 bzcheom.exe 1088 bzcheom.exe 1088 bzcheom.exe 1088 bzcheom.exe -
Suspicious behavior: GetForegroundWindowSpam 3 IoCs
pid Process 4588 5f3283334f76bad1f60f28f29a59fd43_JaffaCakes118.exe 1088 bzcheom.exe 3676 Install_Flash_Player.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4588 wrote to memory of 1088 4588 5f3283334f76bad1f60f28f29a59fd43_JaffaCakes118.exe 90 PID 4588 wrote to memory of 1088 4588 5f3283334f76bad1f60f28f29a59fd43_JaffaCakes118.exe 90 PID 4588 wrote to memory of 1088 4588 5f3283334f76bad1f60f28f29a59fd43_JaffaCakes118.exe 90 PID 1088 wrote to memory of 1640 1088 bzcheom.exe 96 PID 1088 wrote to memory of 1640 1088 bzcheom.exe 96 PID 1088 wrote to memory of 1640 1088 bzcheom.exe 96 PID 1088 wrote to memory of 1640 1088 bzcheom.exe 96 PID 1088 wrote to memory of 1640 1088 bzcheom.exe 96 PID 1088 wrote to memory of 1640 1088 bzcheom.exe 96 PID 1088 wrote to memory of 1640 1088 bzcheom.exe 96 PID 1088 wrote to memory of 1640 1088 bzcheom.exe 96 PID 1088 wrote to memory of 1640 1088 bzcheom.exe 96 PID 1088 wrote to memory of 1640 1088 bzcheom.exe 96 PID 1088 wrote to memory of 1640 1088 bzcheom.exe 96 PID 1088 wrote to memory of 1640 1088 bzcheom.exe 96 PID 1088 wrote to memory of 1640 1088 bzcheom.exe 96 PID 1088 wrote to memory of 1640 1088 bzcheom.exe 96 PID 1088 wrote to memory of 1640 1088 bzcheom.exe 96 PID 1088 wrote to memory of 1640 1088 bzcheom.exe 96 PID 1088 wrote to memory of 1640 1088 bzcheom.exe 96 PID 1088 wrote to memory of 1640 1088 bzcheom.exe 96 PID 1088 wrote to memory of 1640 1088 bzcheom.exe 96 PID 1088 wrote to memory of 1640 1088 bzcheom.exe 96 PID 1088 wrote to memory of 1640 1088 bzcheom.exe 96 PID 1088 wrote to memory of 1640 1088 bzcheom.exe 96 PID 1088 wrote to memory of 1640 1088 bzcheom.exe 96 PID 1088 wrote to memory of 1640 1088 bzcheom.exe 96 PID 1088 wrote to memory of 1640 1088 bzcheom.exe 96 PID 1088 wrote to memory of 1640 1088 bzcheom.exe 96 PID 1088 wrote to memory of 1640 1088 bzcheom.exe 96 PID 1088 wrote to memory of 1640 1088 bzcheom.exe 96 PID 1088 wrote to memory of 1640 1088 bzcheom.exe 96 PID 1088 wrote to memory of 1640 1088 bzcheom.exe 96 PID 1088 wrote to memory of 1640 1088 bzcheom.exe 96 PID 1088 wrote to memory of 1640 1088 bzcheom.exe 96 PID 1088 wrote to memory of 1640 1088 bzcheom.exe 96 PID 1088 wrote to memory of 1640 1088 bzcheom.exe 96 PID 1088 wrote to memory of 1640 1088 bzcheom.exe 96 PID 1088 wrote to memory of 1640 1088 bzcheom.exe 96 PID 1088 wrote to memory of 1640 1088 bzcheom.exe 96 PID 1088 wrote to memory of 1640 1088 bzcheom.exe 96 PID 1088 wrote to memory of 1640 1088 bzcheom.exe 96 PID 1088 wrote to memory of 1640 1088 bzcheom.exe 96 PID 1088 wrote to memory of 1640 1088 bzcheom.exe 96 PID 1088 wrote to memory of 1640 1088 bzcheom.exe 96 PID 1088 wrote to memory of 1640 1088 bzcheom.exe 96 PID 1088 wrote to memory of 1640 1088 bzcheom.exe 96 PID 1088 wrote to memory of 1640 1088 bzcheom.exe 96 PID 1088 wrote to memory of 1640 1088 bzcheom.exe 96 PID 1088 wrote to memory of 1640 1088 bzcheom.exe 96 PID 1088 wrote to memory of 1640 1088 bzcheom.exe 96 PID 1088 wrote to memory of 1640 1088 bzcheom.exe 96 PID 1088 wrote to memory of 1640 1088 bzcheom.exe 96 PID 1088 wrote to memory of 1640 1088 bzcheom.exe 96 PID 1088 wrote to memory of 1640 1088 bzcheom.exe 96 PID 1088 wrote to memory of 1640 1088 bzcheom.exe 96 PID 1088 wrote to memory of 1640 1088 bzcheom.exe 96 PID 1088 wrote to memory of 1640 1088 bzcheom.exe 96 PID 1088 wrote to memory of 1640 1088 bzcheom.exe 96 PID 1088 wrote to memory of 1640 1088 bzcheom.exe 96 PID 1088 wrote to memory of 1640 1088 bzcheom.exe 96 PID 1088 wrote to memory of 1640 1088 bzcheom.exe 96 PID 1088 wrote to memory of 1640 1088 bzcheom.exe 96 PID 1088 wrote to memory of 1640 1088 bzcheom.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f3283334f76bad1f60f28f29a59fd43_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5f3283334f76bad1f60f28f29a59fd43_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 5162⤵
- Program crash
PID:3460
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\bzcheom.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\bzcheom.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 5163⤵
- Program crash
PID:4348
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe3⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\Install_Flash_Player.exe"C:\Users\Admin\AppData\Local\Temp\Install_Flash_Player.exe" rFo2IXjdwUP4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
PID:3676 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3676 -s 6005⤵
- Program crash
PID:1768
-
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\system32\ipconfig.exe" /renew5⤵
- Gathers network information
PID:2220
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4588 -ip 45881⤵PID:1496
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1088 -ip 10881⤵PID:5100
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3676 -ip 36761⤵PID:4480
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129KB
MD55f3283334f76bad1f60f28f29a59fd43
SHA14b491e84bda602c3f907608285130c6148683357
SHA256b74b4376c4ddec0dda13b4cbfbe4713c7e3a30e05cf3223503ed29efe78a17a9
SHA5124fd584159a1592adf04d15d04f77ed89f2918a5d4201a05a7b132d260bb3dc7fb713a33b5214e7751743780d430da90f894eb3e38813a345e6e4368eea0cd0ea