Analysis
-
max time kernel
145s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
17/08/2024, 09:15
Static task
static1
Behavioral task
behavioral1
Sample
a1fba4fc7c545df03dd41273464f5a2e_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
a1fba4fc7c545df03dd41273464f5a2e_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a1fba4fc7c545df03dd41273464f5a2e_JaffaCakes118.exe
-
Size
345KB
-
MD5
a1fba4fc7c545df03dd41273464f5a2e
-
SHA1
2db1c86675229b25fd35bc1e641d74042e370456
-
SHA256
4f5de3312e1ba01d315405cbdb6d708d1d45deb7da4718accc6c92d89cc43bdb
-
SHA512
f6b2506bf491ec587b1534aee2b69658613c5b810b4cc6a04c0eb5aa2dbf5b5574d4ebb4b104393fd80ef8b578b6c0a740cd5872132f37d9e2343191e3e23267
-
SSDEEP
6144:qejcG1q9Y8PbwsZOenCoTh93NphmLAvWkddgcU1y4UwE:qIcG1qjbFOy93fhUeTVU1y4M
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation a1fba4fc7c545df03dd41273464f5a2e_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 2392 hylldknr.exe -
Loads dropped DLL 1 IoCs
pid Process 2392 hylldknr.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 2056 1648 WerFault.exe 83 4832 2392 WerFault.exe 96 -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hylldknr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a1fba4fc7c545df03dd41273464f5a2e_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 772 cmd.exe 2992 PING.EXE -
Kills process with taskkill 1 IoCs
pid Process 3700 taskkill.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2992 PING.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3700 taskkill.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1648 wrote to memory of 772 1648 a1fba4fc7c545df03dd41273464f5a2e_JaffaCakes118.exe 91 PID 1648 wrote to memory of 772 1648 a1fba4fc7c545df03dd41273464f5a2e_JaffaCakes118.exe 91 PID 1648 wrote to memory of 772 1648 a1fba4fc7c545df03dd41273464f5a2e_JaffaCakes118.exe 91 PID 772 wrote to memory of 3700 772 cmd.exe 93 PID 772 wrote to memory of 3700 772 cmd.exe 93 PID 772 wrote to memory of 3700 772 cmd.exe 93 PID 772 wrote to memory of 2992 772 cmd.exe 95 PID 772 wrote to memory of 2992 772 cmd.exe 95 PID 772 wrote to memory of 2992 772 cmd.exe 95 PID 772 wrote to memory of 2392 772 cmd.exe 96 PID 772 wrote to memory of 2392 772 cmd.exe 96 PID 772 wrote to memory of 2392 772 cmd.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\a1fba4fc7c545df03dd41273464f5a2e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a1fba4fc7c545df03dd41273464f5a2e_JaffaCakes118.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1648 -s 5562⤵
- Program crash
PID:2056
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /f /pid 1648 & ping -n 3 127.1 & del /f /q "C:\Users\Admin\AppData\Local\Temp\a1fba4fc7c545df03dd41273464f5a2e_JaffaCakes118.exe" & start C:\Users\Admin\AppData\Local\hylldknr.exe -f2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /pid 16483⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3700
-
-
C:\Windows\SysWOW64\PING.EXEping -n 3 127.13⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2992
-
-
C:\Users\Admin\AppData\Local\hylldknr.exeC:\Users\Admin\AppData\Local\hylldknr.exe -f3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2392 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 5684⤵
- Program crash
PID:4832
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1648 -ip 16481⤵PID:4404
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2392 -ip 23921⤵PID:5048
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
345KB
MD5a1fba4fc7c545df03dd41273464f5a2e
SHA12db1c86675229b25fd35bc1e641d74042e370456
SHA2564f5de3312e1ba01d315405cbdb6d708d1d45deb7da4718accc6c92d89cc43bdb
SHA512f6b2506bf491ec587b1534aee2b69658613c5b810b4cc6a04c0eb5aa2dbf5b5574d4ebb4b104393fd80ef8b578b6c0a740cd5872132f37d9e2343191e3e23267