Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
26-07-2024 16:49
Static task
static1
Behavioral task
behavioral1
Sample
74e5ed5269a7436d2c634d718dd0a36a_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
74e5ed5269a7436d2c634d718dd0a36a_JaffaCakes118.exe
-
Size
169KB
-
MD5
74e5ed5269a7436d2c634d718dd0a36a
-
SHA1
9f96d79d44fd3d5e62345bb112c35b5653775379
-
SHA256
9f1f28be4c21032cba96c553adf0b3b0874020bbc3caf7da31be41df464aa5cf
-
SHA512
cd2f3ff28b49a0faded600390f03ec61845f943cfb2b1b231e3dbab441107a34bd8a824de2a080e9249c609a653268c4c057f084ba63273cd439e89e9d3e69b0
-
SSDEEP
3072:FXKqLsn1Qbx8JQiKpZHekPD0qBxc9XOLWEqtaYGnPxENBbealADWCUgC61:F2SbxmQiuH7PD0qBxuXOCiYOPxENBK5D
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
audioadg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run audioadg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Microsoft® Windows® Operating System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\System\\audioadg.exe" audioadg.exe -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
74e5ed5269a7436d2c634d718dd0a36a_JaffaCakes118.exeexplorer.exeexplorer.exeWmiprwsd.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation 74e5ed5269a7436d2c634d718dd0a36a_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation explorer.exe Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation explorer.exe Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation Wmiprwsd.exe -
Deletes itself 1 IoCs
Processes:
explorer.exepid process 4908 explorer.exe -
Executes dropped EXE 8 IoCs
Processes:
explorer.exeexplorer.exeaudioadg.exeWmiprwsd.exeWmiprwsd.exeTemp.exeTemp.exeTemp.exepid process 4908 explorer.exe 184 explorer.exe 3924 audioadg.exe 4376 Wmiprwsd.exe 220 Wmiprwsd.exe 3132 Temp.exe 4964 Temp.exe 3156 Temp.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
audioadg.exeTemp.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\System\\audioadg.exe" audioadg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Temp.exe" Temp.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
explorer.exeWmiprwsd.exeTemp.exedescription pid process target process PID 4908 set thread context of 184 4908 explorer.exe explorer.exe PID 4376 set thread context of 220 4376 Wmiprwsd.exe Wmiprwsd.exe PID 3132 set thread context of 4964 3132 Temp.exe Temp.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
Temp.exeTemp.exe74e5ed5269a7436d2c634d718dd0a36a_JaffaCakes118.exeexplorer.exeaudioadg.exeWmiprwsd.exeWmiprwsd.exeexplorer.exeTemp.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Temp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Temp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 74e5ed5269a7436d2c634d718dd0a36a_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language audioadg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Wmiprwsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Wmiprwsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Temp.exe -
Modifies registry class 2 IoCs
Processes:
explorer.exeWmiprwsd.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Wmiprwsd.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
explorer.exeaudioadg.exeWmiprwsd.exeTemp.exeTemp.exepid process 4908 explorer.exe 3924 audioadg.exe 4376 Wmiprwsd.exe 3132 Temp.exe 3156 Temp.exe 4908 explorer.exe 4376 Wmiprwsd.exe 3132 Temp.exe 3156 Temp.exe 4908 explorer.exe 4376 Wmiprwsd.exe 3132 Temp.exe 3156 Temp.exe 4908 explorer.exe 4376 Wmiprwsd.exe 3132 Temp.exe 3156 Temp.exe 4908 explorer.exe 4376 Wmiprwsd.exe 3132 Temp.exe 3156 Temp.exe 4908 explorer.exe 4376 Wmiprwsd.exe 3132 Temp.exe 3156 Temp.exe 4908 explorer.exe 4376 Wmiprwsd.exe 3132 Temp.exe 3156 Temp.exe 4908 explorer.exe 4376 Wmiprwsd.exe 3132 Temp.exe 3156 Temp.exe 4908 explorer.exe 4376 Wmiprwsd.exe 3132 Temp.exe 3156 Temp.exe 4908 explorer.exe 4376 Wmiprwsd.exe 3132 Temp.exe 3156 Temp.exe 4908 explorer.exe 4376 Wmiprwsd.exe 3132 Temp.exe 3156 Temp.exe 4908 explorer.exe 4376 Wmiprwsd.exe 3924 audioadg.exe 3132 Temp.exe 3156 Temp.exe 4908 explorer.exe 4376 Wmiprwsd.exe 3924 audioadg.exe 3132 Temp.exe 3156 Temp.exe 4908 explorer.exe 4376 Wmiprwsd.exe 3924 audioadg.exe 3132 Temp.exe 3156 Temp.exe 4908 explorer.exe 4376 Wmiprwsd.exe 3924 audioadg.exe 3132 Temp.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
74e5ed5269a7436d2c634d718dd0a36a_JaffaCakes118.exeexplorer.exeaudioadg.exeWmiprwsd.exeTemp.exeTemp.exedescription pid process Token: SeDebugPrivilege 948 74e5ed5269a7436d2c634d718dd0a36a_JaffaCakes118.exe Token: SeDebugPrivilege 4908 explorer.exe Token: SeDebugPrivilege 3924 audioadg.exe Token: SeDebugPrivilege 4376 Wmiprwsd.exe Token: SeDebugPrivilege 3132 Temp.exe Token: SeDebugPrivilege 3156 Temp.exe -
Suspicious use of WriteProcessMemory 57 IoCs
Processes:
74e5ed5269a7436d2c634d718dd0a36a_JaffaCakes118.exeexplorer.exeaudioadg.exeWmiprwsd.exeexplorer.exeTemp.exeWmiprwsd.exeTemp.exedescription pid process target process PID 948 wrote to memory of 4908 948 74e5ed5269a7436d2c634d718dd0a36a_JaffaCakes118.exe explorer.exe PID 948 wrote to memory of 4908 948 74e5ed5269a7436d2c634d718dd0a36a_JaffaCakes118.exe explorer.exe PID 948 wrote to memory of 4908 948 74e5ed5269a7436d2c634d718dd0a36a_JaffaCakes118.exe explorer.exe PID 4908 wrote to memory of 184 4908 explorer.exe explorer.exe PID 4908 wrote to memory of 184 4908 explorer.exe explorer.exe PID 4908 wrote to memory of 184 4908 explorer.exe explorer.exe PID 4908 wrote to memory of 184 4908 explorer.exe explorer.exe PID 4908 wrote to memory of 184 4908 explorer.exe explorer.exe PID 4908 wrote to memory of 184 4908 explorer.exe explorer.exe PID 4908 wrote to memory of 184 4908 explorer.exe explorer.exe PID 4908 wrote to memory of 184 4908 explorer.exe explorer.exe PID 4908 wrote to memory of 184 4908 explorer.exe explorer.exe PID 4908 wrote to memory of 184 4908 explorer.exe explorer.exe PID 4908 wrote to memory of 184 4908 explorer.exe explorer.exe PID 4908 wrote to memory of 184 4908 explorer.exe explorer.exe PID 4908 wrote to memory of 184 4908 explorer.exe explorer.exe PID 4908 wrote to memory of 3924 4908 explorer.exe audioadg.exe PID 4908 wrote to memory of 3924 4908 explorer.exe audioadg.exe PID 4908 wrote to memory of 3924 4908 explorer.exe audioadg.exe PID 3924 wrote to memory of 4376 3924 audioadg.exe Wmiprwsd.exe PID 3924 wrote to memory of 4376 3924 audioadg.exe Wmiprwsd.exe PID 3924 wrote to memory of 4376 3924 audioadg.exe Wmiprwsd.exe PID 4376 wrote to memory of 220 4376 Wmiprwsd.exe Wmiprwsd.exe PID 4376 wrote to memory of 220 4376 Wmiprwsd.exe Wmiprwsd.exe PID 4376 wrote to memory of 220 4376 Wmiprwsd.exe Wmiprwsd.exe PID 4376 wrote to memory of 220 4376 Wmiprwsd.exe Wmiprwsd.exe PID 4376 wrote to memory of 220 4376 Wmiprwsd.exe Wmiprwsd.exe PID 4376 wrote to memory of 220 4376 Wmiprwsd.exe Wmiprwsd.exe PID 4376 wrote to memory of 220 4376 Wmiprwsd.exe Wmiprwsd.exe PID 4376 wrote to memory of 220 4376 Wmiprwsd.exe Wmiprwsd.exe PID 4376 wrote to memory of 220 4376 Wmiprwsd.exe Wmiprwsd.exe PID 4376 wrote to memory of 220 4376 Wmiprwsd.exe Wmiprwsd.exe PID 4376 wrote to memory of 220 4376 Wmiprwsd.exe Wmiprwsd.exe PID 4376 wrote to memory of 220 4376 Wmiprwsd.exe Wmiprwsd.exe PID 4376 wrote to memory of 220 4376 Wmiprwsd.exe Wmiprwsd.exe PID 184 wrote to memory of 3132 184 explorer.exe Temp.exe PID 184 wrote to memory of 3132 184 explorer.exe Temp.exe PID 184 wrote to memory of 3132 184 explorer.exe Temp.exe PID 3132 wrote to memory of 4964 3132 Temp.exe Temp.exe PID 3132 wrote to memory of 4964 3132 Temp.exe Temp.exe PID 3132 wrote to memory of 4964 3132 Temp.exe Temp.exe PID 3132 wrote to memory of 4964 3132 Temp.exe Temp.exe PID 3132 wrote to memory of 4964 3132 Temp.exe Temp.exe PID 3132 wrote to memory of 4964 3132 Temp.exe Temp.exe PID 3132 wrote to memory of 4964 3132 Temp.exe Temp.exe PID 3132 wrote to memory of 4964 3132 Temp.exe Temp.exe PID 3132 wrote to memory of 4964 3132 Temp.exe Temp.exe PID 3132 wrote to memory of 4964 3132 Temp.exe Temp.exe PID 3132 wrote to memory of 4964 3132 Temp.exe Temp.exe PID 3132 wrote to memory of 4964 3132 Temp.exe Temp.exe PID 3132 wrote to memory of 4964 3132 Temp.exe Temp.exe PID 220 wrote to memory of 3156 220 Wmiprwsd.exe Temp.exe PID 220 wrote to memory of 3156 220 Wmiprwsd.exe Temp.exe PID 220 wrote to memory of 3156 220 Wmiprwsd.exe Temp.exe PID 3156 wrote to memory of 4576 3156 Temp.exe Temp.exe PID 3156 wrote to memory of 4576 3156 Temp.exe Temp.exe PID 3156 wrote to memory of 4576 3156 Temp.exe Temp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\74e5ed5269a7436d2c634d718dd0a36a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\74e5ed5269a7436d2c634d718dd0a36a_JaffaCakes118.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\explorer.exe"C:\Users\Admin\Documents\explorer.exe"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\explorer.exeC:\Users\Admin\Documents\explorer.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Temp.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Temp.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Temp.exeC:\Users\Admin\AppData\Roaming\Microsoft\Temp.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\System\audioadg.exe"C:\Users\Admin\AppData\Local\Temp\System\audioadg.exe"3⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\System\Wmiprwsd.exeC:\Users\Admin\AppData\Local\Temp\System\Wmiprwsd.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\System\Wmiprwsd.exeC:\Users\Admin\AppData\Local\Temp\System\Wmiprwsd.exe5⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Temp.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Temp.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Temp.exeC:\Users\Admin\AppData\Roaming\Microsoft\Temp.exe7⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\SysInfo.txtFilesize
55B
MD50cb5c42fd26af3137f9b847cdaf6678d
SHA1abdad38dffdd2aea628f93f2c55c8a958828866a
SHA256de836f24bdfc49d9ff1edb1b52d2f5e5e19352e43c95e4fb1d8e1691d290d4e1
SHA5129e17b6a6694855900e5fb20975bdd98e536c9095d36c02ba671cb9cf0850ebe1546f5a35bd175021f687ddd1412985ef105940d88d469b9328a200be1cb35517
-
C:\Users\Admin\AppData\Local\Temp\SysInfo.txtFilesize
86B
MD5f4c1b2ab4c900cbc78cb94aa076b0273
SHA13594b28990ed6c519013096d09e2514efebe4710
SHA256d8ab752eb5e186c5ca9745cd078577ef759a82c93686446eade4edc613dceafa
SHA512630d89abb641d602eb0dfcab2740d9443f8edd5c72411b517186e699414c44d916e78ebc4f3cccad64f528107ab502b4b469c75f38e868343897f444298edead
-
C:\Users\Admin\AppData\Local\Temp\SysInfo.txtFilesize
51B
MD52d421d5d27c83a8d80478ccded23873a
SHA19849b69bcaed8b6fca38e9fc17e2abbd7df5ca7d
SHA2566d513e948a16ca79064e0d510b8b92fb6a84434a1b60744567aafec3820cbb26
SHA512df6e37db8131242d12d07fe36f4190f884babe5ef80d2160bc45918c621e3ce05ddfb2ddf494ff62494f8faf61b9f219c3a89688993c317a7ba5440d84ab3631
-
C:\Users\Admin\AppData\Local\Temp\System\audioadg.exeFilesize
8KB
MD56ac73d462625d27d9f0f599ca1190dea
SHA1746cbcaf898421e361baa72ac5400d6e5d6ef732
SHA256fa35e4d655c8d1eefd9d4bacab0f6d932bd061e23c49503af747161248307f0c
SHA5125789644e331955e2363fd45e45a49bb4266b01ab772d503a8324e4d126ddb2e244297462030a4c63c0088551ef6cac94fa460e4f7ce9f844757afdca4a5d4601
-
C:\Users\Admin\Documents\explorer.exeFilesize
169KB
MD574e5ed5269a7436d2c634d718dd0a36a
SHA19f96d79d44fd3d5e62345bb112c35b5653775379
SHA2569f1f28be4c21032cba96c553adf0b3b0874020bbc3caf7da31be41df464aa5cf
SHA512cd2f3ff28b49a0faded600390f03ec61845f943cfb2b1b231e3dbab441107a34bd8a824de2a080e9249c609a653268c4c057f084ba63273cd439e89e9d3e69b0
-
memory/184-23-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/184-25-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/184-26-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/948-18-0x0000000075220000-0x00000000757D1000-memory.dmpFilesize
5.7MB
-
memory/948-0-0x0000000075222000-0x0000000075223000-memory.dmpFilesize
4KB
-
memory/948-2-0x0000000075220000-0x00000000757D1000-memory.dmpFilesize
5.7MB
-
memory/948-1-0x0000000075220000-0x00000000757D1000-memory.dmpFilesize
5.7MB
-
memory/4908-17-0x0000000075220000-0x00000000757D1000-memory.dmpFilesize
5.7MB
-
memory/4908-21-0x0000000075220000-0x00000000757D1000-memory.dmpFilesize
5.7MB
-
memory/4908-74-0x0000000075220000-0x00000000757D1000-memory.dmpFilesize
5.7MB