Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system -
submitted
01-08-2024 21:32
Static task
static1
Behavioral task
behavioral1
Sample
81cce2a851bcc14168b7d91312a9dd90_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
81cce2a851bcc14168b7d91312a9dd90_JaffaCakes118.exe
Resource
win10v2004-20240730-en
General
-
Target
81cce2a851bcc14168b7d91312a9dd90_JaffaCakes118.exe
-
Size
97KB
-
MD5
81cce2a851bcc14168b7d91312a9dd90
-
SHA1
80fb55b9cbb26f5ddc865d265f5c384d44ab6739
-
SHA256
4e1035a690cba57405aec7087f8c64db6f155b52d8b3d8cec0419457492d5dba
-
SHA512
dd836d023d8ab0d78f842ef77698d7746e8ad5b547f0d9896f5fe804d3fb2f65cf1040e31e4c27a6abfb488c9c8dbee3ce9a09b43aa4b37ae3998855b88256e2
-
SSDEEP
1536:LomRneKYpTuoqFnMyoBHmXE5gxRdd/1PqSOX/U/YNxb2Z9IPPisafhw:L/eLpKoEn0VL5qZP+aYPXww
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000\Control Panel\International\Geo\Nation 81cce2a851bcc14168b7d91312a9dd90_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000\Control Panel\International\Geo\Nation 81cce2a851bcc14168b7d91312a9dd90_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000\Control Panel\International\Geo\Nation 81cce2a851bcc14168b7d91312a9dd90_JaffaCakes118.exe -
Executes dropped EXE 3 IoCs
pid Process 3128 7E2QkARf.exe 5088 7E2QkARf.exe 800 7E2QkARf.exe -
Unexpected DNS network traffic destination 5 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 188.190.98.22 Destination IP 188.190.98.22 Destination IP 188.190.98.22 Destination IP 188.190.98.22 Destination IP 188.190.98.22 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 81cce2a851bcc14168b7d91312a9dd90_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E2QkARf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 81cce2a851bcc14168b7d91312a9dd90_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 81cce2a851bcc14168b7d91312a9dd90_JaffaCakes118.exe -
Modifies Internet Explorer Protected Mode 1 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3" 81cce2a851bcc14168b7d91312a9dd90_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3" 7E2QkARf.exe Set value (int) \REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3" 81cce2a851bcc14168b7d91312a9dd90_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3" 7E2QkARf.exe Set value (int) \REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3" 81cce2a851bcc14168b7d91312a9dd90_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3" 7E2QkARf.exe -
Modifies Internet Explorer Protected Mode Banner 1 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000\SOFTWARE\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1" 81cce2a851bcc14168b7d91312a9dd90_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000\SOFTWARE\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1" 7E2QkARf.exe Set value (int) \REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000\SOFTWARE\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1" 81cce2a851bcc14168b7d91312a9dd90_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000\SOFTWARE\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1" 7E2QkARf.exe Set value (int) \REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000\SOFTWARE\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1" 81cce2a851bcc14168b7d91312a9dd90_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000\SOFTWARE\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1" 7E2QkARf.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000\SOFTWARE\Microsoft\Internet Explorer\Main\DisableScriptDebuggerIE = "yes" 7E2QkARf.exe Set value (str) \REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000\SOFTWARE\Microsoft\Internet Explorer\Main\DisableScriptDebuggerIE = "yes" 81cce2a851bcc14168b7d91312a9dd90_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000\SOFTWARE\Microsoft\Internet Explorer\Main\DisableScriptDebuggerIE = "yes" 81cce2a851bcc14168b7d91312a9dd90_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Error Dlg Displayed On Every Error = "no" 81cce2a851bcc14168b7d91312a9dd90_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000\SOFTWARE\Microsoft\Internet Explorer\Main\DisableScriptDebuggerIE = "yes" 7E2QkARf.exe Set value (str) \REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Error Dlg Displayed On Every Error = "no" 7E2QkARf.exe Set value (str) \REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Error Dlg Displayed On Every Error = "no" 81cce2a851bcc14168b7d91312a9dd90_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000\SOFTWARE\Microsoft\Internet Explorer\Main\DisableScriptDebuggerIE = "yes" 81cce2a851bcc14168b7d91312a9dd90_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Error Dlg Displayed On Every Error = "no" 7E2QkARf.exe Set value (str) \REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Error Dlg Displayed On Every Error = "no" 81cce2a851bcc14168b7d91312a9dd90_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000\SOFTWARE\Microsoft\Internet Explorer\Main\DisableScriptDebuggerIE = "yes" 7E2QkARf.exe Set value (str) \REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Error Dlg Displayed On Every Error = "no" 7E2QkARf.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3476 81cce2a851bcc14168b7d91312a9dd90_JaffaCakes118.exe 3476 81cce2a851bcc14168b7d91312a9dd90_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3476 wrote to memory of 3128 3476 81cce2a851bcc14168b7d91312a9dd90_JaffaCakes118.exe 86 PID 3476 wrote to memory of 3128 3476 81cce2a851bcc14168b7d91312a9dd90_JaffaCakes118.exe 86 PID 3476 wrote to memory of 3128 3476 81cce2a851bcc14168b7d91312a9dd90_JaffaCakes118.exe 86 PID 3476 wrote to memory of 1976 3476 81cce2a851bcc14168b7d91312a9dd90_JaffaCakes118.exe 91 PID 3476 wrote to memory of 1976 3476 81cce2a851bcc14168b7d91312a9dd90_JaffaCakes118.exe 91 PID 3476 wrote to memory of 1976 3476 81cce2a851bcc14168b7d91312a9dd90_JaffaCakes118.exe 91 PID 1976 wrote to memory of 5088 1976 81cce2a851bcc14168b7d91312a9dd90_JaffaCakes118.exe 92 PID 1976 wrote to memory of 5088 1976 81cce2a851bcc14168b7d91312a9dd90_JaffaCakes118.exe 92 PID 1976 wrote to memory of 5088 1976 81cce2a851bcc14168b7d91312a9dd90_JaffaCakes118.exe 92 PID 1976 wrote to memory of 4904 1976 81cce2a851bcc14168b7d91312a9dd90_JaffaCakes118.exe 93 PID 1976 wrote to memory of 4904 1976 81cce2a851bcc14168b7d91312a9dd90_JaffaCakes118.exe 93 PID 1976 wrote to memory of 4904 1976 81cce2a851bcc14168b7d91312a9dd90_JaffaCakes118.exe 93 PID 4904 wrote to memory of 800 4904 81cce2a851bcc14168b7d91312a9dd90_JaffaCakes118.exe 94 PID 4904 wrote to memory of 800 4904 81cce2a851bcc14168b7d91312a9dd90_JaffaCakes118.exe 94 PID 4904 wrote to memory of 800 4904 81cce2a851bcc14168b7d91312a9dd90_JaffaCakes118.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\81cce2a851bcc14168b7d91312a9dd90_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\81cce2a851bcc14168b7d91312a9dd90_JaffaCakes118.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\ProgramData\7E2QkARf.exe"C:\ProgramData\7E2QkARf.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
PID:3128
-
-
C:\Users\Admin\AppData\Local\Temp\81cce2a851bcc14168b7d91312a9dd90_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\81cce2a851bcc14168b7d91312a9dd90_JaffaCakes118.exe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\ProgramData\7E2QkARf.exe"C:\ProgramData\7E2QkARf.exe"3⤵
- Executes dropped EXE
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
PID:5088
-
-
C:\Users\Admin\AppData\Local\Temp\81cce2a851bcc14168b7d91312a9dd90_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\81cce2a851bcc14168b7d91312a9dd90_JaffaCakes118.exe"3⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\ProgramData\7E2QkARf.exe"C:\ProgramData\7E2QkARf.exe"4⤵
- Executes dropped EXE
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
PID:800
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD581cce2a851bcc14168b7d91312a9dd90
SHA180fb55b9cbb26f5ddc865d265f5c384d44ab6739
SHA2564e1035a690cba57405aec7087f8c64db6f155b52d8b3d8cec0419457492d5dba
SHA512dd836d023d8ab0d78f842ef77698d7746e8ad5b547f0d9896f5fe804d3fb2f65cf1040e31e4c27a6abfb488c9c8dbee3ce9a09b43aa4b37ae3998855b88256e2