Analysis
-
max time kernel
140s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
11-08-2024 05:05
Static task
static1
Behavioral task
behavioral1
Sample
891a9b86a23939e3c5dab87dd2da4852_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
891a9b86a23939e3c5dab87dd2da4852_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
891a9b86a23939e3c5dab87dd2da4852_JaffaCakes118.exe
-
Size
413KB
-
MD5
891a9b86a23939e3c5dab87dd2da4852
-
SHA1
909f654457229eb0088b0d148dcf6fec1910df90
-
SHA256
e3593313076e535c8e2ef2ed9ac585e305d638faec47221bf2ab352645e0bc3d
-
SHA512
06fb50c0e807e93d065b78d95f4ef63af988c8470c16d91daea475f86bde7cc537b95164109e78c4fa2a1683a320928f255c0b274091615c49e55dafc67d7e72
-
SSDEEP
12288:EIZIJ8lG4tCZasV15i27y1CzIOSDbckdU+hh/iz09Z2Fg+3e98:HZIJ8lG4tC0sZi270RwTZ2Z2/
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation 891a9b86a23939e3c5dab87dd2da4852_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 1748 Server_Setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 4804 1748 WerFault.exe 91 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 891a9b86a23939e3c5dab87dd2da4852_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server_Setup.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4664 wrote to memory of 1748 4664 891a9b86a23939e3c5dab87dd2da4852_JaffaCakes118.exe 91 PID 4664 wrote to memory of 1748 4664 891a9b86a23939e3c5dab87dd2da4852_JaffaCakes118.exe 91 PID 4664 wrote to memory of 1748 4664 891a9b86a23939e3c5dab87dd2da4852_JaffaCakes118.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\891a9b86a23939e3c5dab87dd2da4852_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\891a9b86a23939e3c5dab87dd2da4852_JaffaCakes118.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\Server_Setup.exe"C:\Users\Admin\AppData\Local\Temp\Server_Setup.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1748 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1748 -s 2203⤵
- Program crash
PID:4804
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1748 -ip 17481⤵PID:4468
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3960,i,15436195446242760253,4000484513008731869,262144 --variations-seed-version --mojo-platform-channel-handle=3784 /prefetch:81⤵PID:1236
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
720KB
MD55aabfd1d1415c8037be6948d23414089
SHA15c2ce517b1f27131c5cb7b173dc74f9198ecc68a
SHA2566e70345aa3e3d6aa6afa0161ab1967058ec477ff9ba12e1d3c072e4d3ddf6df2
SHA51247de5026d608c7d2e73e76abf58b8c569b611873e2a592a5a47f6fdc874330e706f9bd763b6414a2838e4406d02556852fc7d999557fc8b86eaa30cd2ffb2b85