Analysis
-
max time kernel
140s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
20/08/2024, 14:08
Behavioral task
behavioral1
Sample
af86367b5ca0153f6b0bfa4af35a634c_JaffaCakes118.exe
Resource
win7-20240729-en
windows7-x64
5 signatures
150 seconds
General
-
Target
af86367b5ca0153f6b0bfa4af35a634c_JaffaCakes118.exe
-
Size
106KB
-
MD5
af86367b5ca0153f6b0bfa4af35a634c
-
SHA1
e51e378a5ec4ee6f3f54c13ccb442fb2e533ec38
-
SHA256
60b6bcfaa46dd46c6f7eb0930288cb4b3fce9c3815c148a86904f823b82379e4
-
SHA512
57a7e1979928b57a2815ad9c33984a09fe8561c848d9251804d1584fda121b0882ea3c28490f7c83c5dcee93a651e7fd94386da9a0e30835ac6da5e21912c199
-
SSDEEP
1536:1ayvRUVU3Epg/bf8F83eVm1ssTm/W4vDo6/NeIgtPRHw/G6VCXKM2crV8efGPwzC:MeCeEkUF8xfm/lne3cGbKgp8efKw
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/3488-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3488-2-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2692-3-0x0000000040010000-0x000000004004C000-memory.dmp upx behavioral2/memory/2692-5-0x0000000040010000-0x000000004004C000-memory.dmp upx behavioral2/memory/2692-8-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language af86367b5ca0153f6b0bfa4af35a634c_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language apocalyps32.exe -
Suspicious behavior: RenamesItself 2 IoCs
pid Process 3488 af86367b5ca0153f6b0bfa4af35a634c_JaffaCakes118.exe 2692 apocalyps32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3488 af86367b5ca0153f6b0bfa4af35a634c_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3488 wrote to memory of 3492 3488 af86367b5ca0153f6b0bfa4af35a634c_JaffaCakes118.exe 56 PID 3488 wrote to memory of 3492 3488 af86367b5ca0153f6b0bfa4af35a634c_JaffaCakes118.exe 56 PID 3488 wrote to memory of 3492 3488 af86367b5ca0153f6b0bfa4af35a634c_JaffaCakes118.exe 56 PID 3488 wrote to memory of 2692 3488 af86367b5ca0153f6b0bfa4af35a634c_JaffaCakes118.exe 99 PID 3488 wrote to memory of 2692 3488 af86367b5ca0153f6b0bfa4af35a634c_JaffaCakes118.exe 99 PID 3488 wrote to memory of 2692 3488 af86367b5ca0153f6b0bfa4af35a634c_JaffaCakes118.exe 99 PID 2692 wrote to memory of 2256 2692 apocalyps32.exe 100 PID 2692 wrote to memory of 2256 2692 apocalyps32.exe 100 PID 2692 wrote to memory of 2256 2692 apocalyps32.exe 100 PID 2692 wrote to memory of 2256 2692 apocalyps32.exe 100 PID 2692 wrote to memory of 2256 2692 apocalyps32.exe 100 PID 2692 wrote to memory of 2256 2692 apocalyps32.exe 100 PID 2692 wrote to memory of 2256 2692 apocalyps32.exe 100 PID 2692 wrote to memory of 2256 2692 apocalyps32.exe 100 PID 2692 wrote to memory of 2256 2692 apocalyps32.exe 100 PID 2692 wrote to memory of 2256 2692 apocalyps32.exe 100 PID 2692 wrote to memory of 2256 2692 apocalyps32.exe 100 PID 2692 wrote to memory of 2256 2692 apocalyps32.exe 100 PID 2692 wrote to memory of 2256 2692 apocalyps32.exe 100 PID 2692 wrote to memory of 2256 2692 apocalyps32.exe 100 PID 2692 wrote to memory of 2256 2692 apocalyps32.exe 100 PID 2692 wrote to memory of 2256 2692 apocalyps32.exe 100 PID 2692 wrote to memory of 2256 2692 apocalyps32.exe 100 PID 2692 wrote to memory of 2256 2692 apocalyps32.exe 100 PID 2692 wrote to memory of 2256 2692 apocalyps32.exe 100 PID 2692 wrote to memory of 2256 2692 apocalyps32.exe 100 PID 2692 wrote to memory of 2256 2692 apocalyps32.exe 100 PID 2692 wrote to memory of 2256 2692 apocalyps32.exe 100 PID 2692 wrote to memory of 2256 2692 apocalyps32.exe 100 PID 2692 wrote to memory of 2256 2692 apocalyps32.exe 100 PID 2692 wrote to memory of 2256 2692 apocalyps32.exe 100 PID 2692 wrote to memory of 2256 2692 apocalyps32.exe 100 PID 2692 wrote to memory of 2256 2692 apocalyps32.exe 100 PID 2692 wrote to memory of 2256 2692 apocalyps32.exe 100 PID 2692 wrote to memory of 2256 2692 apocalyps32.exe 100 PID 2692 wrote to memory of 2256 2692 apocalyps32.exe 100 PID 2692 wrote to memory of 2256 2692 apocalyps32.exe 100 PID 2692 wrote to memory of 2256 2692 apocalyps32.exe 100 PID 2692 wrote to memory of 2256 2692 apocalyps32.exe 100 PID 2692 wrote to memory of 2256 2692 apocalyps32.exe 100 PID 2692 wrote to memory of 2256 2692 apocalyps32.exe 100 PID 2692 wrote to memory of 2256 2692 apocalyps32.exe 100 PID 2692 wrote to memory of 2256 2692 apocalyps32.exe 100 PID 2692 wrote to memory of 2256 2692 apocalyps32.exe 100 PID 2692 wrote to memory of 2256 2692 apocalyps32.exe 100 PID 2692 wrote to memory of 2256 2692 apocalyps32.exe 100 PID 2692 wrote to memory of 2256 2692 apocalyps32.exe 100 PID 2692 wrote to memory of 2256 2692 apocalyps32.exe 100 PID 2692 wrote to memory of 2256 2692 apocalyps32.exe 100 PID 2692 wrote to memory of 2256 2692 apocalyps32.exe 100 PID 2692 wrote to memory of 2256 2692 apocalyps32.exe 100 PID 2692 wrote to memory of 2256 2692 apocalyps32.exe 100 PID 2692 wrote to memory of 2256 2692 apocalyps32.exe 100 PID 2692 wrote to memory of 2256 2692 apocalyps32.exe 100 PID 2692 wrote to memory of 2256 2692 apocalyps32.exe 100 PID 2692 wrote to memory of 2256 2692 apocalyps32.exe 100 PID 2692 wrote to memory of 2256 2692 apocalyps32.exe 100 PID 2692 wrote to memory of 2256 2692 apocalyps32.exe 100 PID 2692 wrote to memory of 2256 2692 apocalyps32.exe 100 PID 2692 wrote to memory of 2256 2692 apocalyps32.exe 100 PID 2692 wrote to memory of 2256 2692 apocalyps32.exe 100 PID 2692 wrote to memory of 2256 2692 apocalyps32.exe 100 PID 2692 wrote to memory of 2256 2692 apocalyps32.exe 100 PID 2692 wrote to memory of 2256 2692 apocalyps32.exe 100
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\af86367b5ca0153f6b0bfa4af35a634c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\af86367b5ca0153f6b0bfa4af35a634c_JaffaCakes118.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Windows\apocalyps32.exe-bs3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"4⤵PID:2256
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4108,i,9445584274764997943,12714240264001792460,262144 --variations-seed-version --mojo-platform-channel-handle=4020 /prefetch:81⤵PID:3632