Analysis
-
max time kernel
6s -
max time network
6s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
20/08/2024, 17:04
Static task
static1
Behavioral task
behavioral1
Sample
b014fbbe2ef14803adb60b9d8259c4af_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
b014fbbe2ef14803adb60b9d8259c4af_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Errors
General
-
Target
b014fbbe2ef14803adb60b9d8259c4af_JaffaCakes118.exe
-
Size
50KB
-
MD5
b014fbbe2ef14803adb60b9d8259c4af
-
SHA1
a140fc48e0734924898eee98933ed486738c289d
-
SHA256
a6f168b6a992a033096edfab8903cf5f0f1b70cc42faee52852307d75aecf81f
-
SHA512
c30ba040b6e381c27f67281efc2fb4baef22a938b7e756d10a011ae35d319faf829a7c4046589c0dd069b76b02287fd1258fb0bafe58ba5c7ea59e73906e0d6b
-
SSDEEP
768:NO7usVVzsBYqxwZd6iLy7RFpvLXuZr32BBaAriUFE0tFmvDRTCkC5HVYPCQ:wyG8wtLyNFxLXKyBhXm0tFmvDaHyP
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation b014fbbe2ef14803adb60b9d8259c4af_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1681432510 = "C:\\Users\\Admin\\1681432510.exe" reg.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b014fbbe2ef14803adb60b9d8259c4af_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language shutdown.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies data under HKEY_USERS 15 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "237" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1776 b014fbbe2ef14803adb60b9d8259c4af_JaffaCakes118.exe Token: SeShutdownPrivilege 5064 shutdown.exe Token: SeRemoteShutdownPrivilege 5064 shutdown.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4072 LogonUI.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1776 wrote to memory of 460 1776 b014fbbe2ef14803adb60b9d8259c4af_JaffaCakes118.exe 84 PID 1776 wrote to memory of 460 1776 b014fbbe2ef14803adb60b9d8259c4af_JaffaCakes118.exe 84 PID 1776 wrote to memory of 460 1776 b014fbbe2ef14803adb60b9d8259c4af_JaffaCakes118.exe 84 PID 460 wrote to memory of 536 460 cmd.exe 86 PID 460 wrote to memory of 536 460 cmd.exe 86 PID 460 wrote to memory of 536 460 cmd.exe 86 PID 1776 wrote to memory of 5064 1776 b014fbbe2ef14803adb60b9d8259c4af_JaffaCakes118.exe 87 PID 1776 wrote to memory of 5064 1776 b014fbbe2ef14803adb60b9d8259c4af_JaffaCakes118.exe 87 PID 1776 wrote to memory of 5064 1776 b014fbbe2ef14803adb60b9d8259c4af_JaffaCakes118.exe 87 PID 1776 wrote to memory of 1384 1776 b014fbbe2ef14803adb60b9d8259c4af_JaffaCakes118.exe 89 PID 1776 wrote to memory of 1384 1776 b014fbbe2ef14803adb60b9d8259c4af_JaffaCakes118.exe 89 PID 1776 wrote to memory of 1384 1776 b014fbbe2ef14803adb60b9d8259c4af_JaffaCakes118.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\b014fbbe2ef14803adb60b9d8259c4af_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b014fbbe2ef14803adb60b9d8259c4af_JaffaCakes118.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Windows\SysWOW64\cmd.execmd.exe /c REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v 1681432510 /t REG_SZ /d "%userprofile%\1681432510.exe" /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:460 -
C:\Windows\SysWOW64\reg.exeREG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v 1681432510 /t REG_SZ /d "C:\Users\Admin\1681432510.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:536
-
-
-
C:\Windows\SysWOW64\shutdown.exe"C:\Windows\System32\shutdown.exe" /r /f /t 32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5064
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\B014FB~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
PID:1384
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa39a7855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4072