Analysis
-
max time kernel
143s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
17/08/2024, 16:26
Static task
static1
Behavioral task
behavioral1
Sample
a3452a11bba40fa1228f26c5ad863a25_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
a3452a11bba40fa1228f26c5ad863a25_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a3452a11bba40fa1228f26c5ad863a25_JaffaCakes118.exe
-
Size
26KB
-
MD5
a3452a11bba40fa1228f26c5ad863a25
-
SHA1
096eb66514dda278c840c1a736a31244b690b0d6
-
SHA256
9975b743a813ae0797112fccfc2c098473f33b06abb66de722655d8136f2c395
-
SHA512
8ac4a7986a4ed9a9c3071414a5e1b29e215c443fcdb20f3bd4fc1af5d9cde3751bb65cec721129c5fb66dbace0f55d02eda41a2151a23c29f29fef0acf93afb6
-
SSDEEP
768:UNlkO4R88wnAVwSYr/aM1uB7gadaScipv/s:5O4dVlYojaFiv/s
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 3136 live.messenger.com 4004 live.messenger.com -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSN Messenger = "live.messenger.com" a3452a11bba40fa1228f26c5ad863a25_JaffaCakes118.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3228 set thread context of 4548 3228 a3452a11bba40fa1228f26c5ad863a25_JaffaCakes118.exe 84 PID 3136 set thread context of 4004 3136 live.messenger.com 86 -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\live.messenger.com a3452a11bba40fa1228f26c5ad863a25_JaffaCakes118.exe File opened for modification C:\Windows\live.messenger.com a3452a11bba40fa1228f26c5ad863a25_JaffaCakes118.exe File created C:\Windows\admintxt.txt live.messenger.com -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language live.messenger.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a3452a11bba40fa1228f26c5ad863a25_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a3452a11bba40fa1228f26c5ad863a25_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language live.messenger.com -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 3228 wrote to memory of 4548 3228 a3452a11bba40fa1228f26c5ad863a25_JaffaCakes118.exe 84 PID 3228 wrote to memory of 4548 3228 a3452a11bba40fa1228f26c5ad863a25_JaffaCakes118.exe 84 PID 3228 wrote to memory of 4548 3228 a3452a11bba40fa1228f26c5ad863a25_JaffaCakes118.exe 84 PID 3228 wrote to memory of 4548 3228 a3452a11bba40fa1228f26c5ad863a25_JaffaCakes118.exe 84 PID 3228 wrote to memory of 4548 3228 a3452a11bba40fa1228f26c5ad863a25_JaffaCakes118.exe 84 PID 4548 wrote to memory of 3136 4548 a3452a11bba40fa1228f26c5ad863a25_JaffaCakes118.exe 85 PID 4548 wrote to memory of 3136 4548 a3452a11bba40fa1228f26c5ad863a25_JaffaCakes118.exe 85 PID 4548 wrote to memory of 3136 4548 a3452a11bba40fa1228f26c5ad863a25_JaffaCakes118.exe 85 PID 3136 wrote to memory of 4004 3136 live.messenger.com 86 PID 3136 wrote to memory of 4004 3136 live.messenger.com 86 PID 3136 wrote to memory of 4004 3136 live.messenger.com 86 PID 3136 wrote to memory of 4004 3136 live.messenger.com 86 PID 3136 wrote to memory of 4004 3136 live.messenger.com 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\a3452a11bba40fa1228f26c5ad863a25_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a3452a11bba40fa1228f26c5ad863a25_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\a3452a11bba40fa1228f26c5ad863a25_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a3452a11bba40fa1228f26c5ad863a25_JaffaCakes118.exe2⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Windows\live.messenger.com"C:\Windows\live.messenger.com"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Windows\live.messenger.comC:\Windows\live.messenger.com4⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4004
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
26KB
MD5a3452a11bba40fa1228f26c5ad863a25
SHA1096eb66514dda278c840c1a736a31244b690b0d6
SHA2569975b743a813ae0797112fccfc2c098473f33b06abb66de722655d8136f2c395
SHA5128ac4a7986a4ed9a9c3071414a5e1b29e215c443fcdb20f3bd4fc1af5d9cde3751bb65cec721129c5fb66dbace0f55d02eda41a2151a23c29f29fef0acf93afb6