Analysis
-
max time kernel
30s -
max time network
44s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
23/08/2024, 10:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bb6078c22a2c4498670dc0d4cabb218f_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
10 signatures
150 seconds
Errors
Reason
Machine shutdown
General
-
Target
bb6078c22a2c4498670dc0d4cabb218f_JaffaCakes118.exe
-
Size
84KB
-
MD5
bb6078c22a2c4498670dc0d4cabb218f
-
SHA1
4601a4b7716e7c738c246f3d18414d2fe723942b
-
SHA256
7984c9446718767760af4c9d098957d3b8d3fb838fdc9da383b0701a1e958cc4
-
SHA512
e94b9a717c464258a33faf05113fd0cc7f99fa0be1af39c86d844cda61c14f9865424b153605194a48618f588a9b719d12fe0934ed4bdbfa2a50401b9e80fb86
-
SSDEEP
1536:RMmxn9AYfc7ybjx4B48q+HTtdwE0+Z0YPL0r:RXt9fsMOB48/H5dwEDzm
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation bb6078c22a2c4498670dc0d4cabb218f_JaffaCakes118.exe -
resource yara_rule behavioral2/memory/1432-2-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/1432-4-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/1432-6-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/1432-7-0x0000000000400000-0x000000000040F000-memory.dmp upx -
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 4780 tasklist.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2828 set thread context of 1432 2828 bb6078c22a2c4498670dc0d4cabb218f_JaffaCakes118.exe 85 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bb6078c22a2c4498670dc0d4cabb218f_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1432 svchost.exe 1432 svchost.exe 1432 svchost.exe 1432 svchost.exe 1432 svchost.exe 1432 svchost.exe 1432 svchost.exe 1432 svchost.exe 1432 svchost.exe 1432 svchost.exe 1432 svchost.exe 1432 svchost.exe 1432 svchost.exe 1432 svchost.exe 1432 svchost.exe 1432 svchost.exe 1432 svchost.exe 1432 svchost.exe 1432 svchost.exe 1432 svchost.exe 1432 svchost.exe 1432 svchost.exe 1432 svchost.exe 1432 svchost.exe 1432 svchost.exe 1432 svchost.exe 1432 svchost.exe 1432 svchost.exe 1432 svchost.exe 1432 svchost.exe 1432 svchost.exe 1432 svchost.exe 1432 svchost.exe 1432 svchost.exe 1432 svchost.exe 1432 svchost.exe 1432 svchost.exe 1432 svchost.exe 1432 svchost.exe 1432 svchost.exe 1432 svchost.exe 1432 svchost.exe 1432 svchost.exe 1432 svchost.exe 1432 svchost.exe 1432 svchost.exe 1432 svchost.exe 1432 svchost.exe 1432 svchost.exe 1432 svchost.exe 1432 svchost.exe 1432 svchost.exe 1432 svchost.exe 1432 svchost.exe 1432 svchost.exe 1432 svchost.exe 1432 svchost.exe 1432 svchost.exe 1432 svchost.exe 1432 svchost.exe 1432 svchost.exe 1432 svchost.exe 1432 svchost.exe 1432 svchost.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4780 tasklist.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2828 bb6078c22a2c4498670dc0d4cabb218f_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2828 wrote to memory of 1432 2828 bb6078c22a2c4498670dc0d4cabb218f_JaffaCakes118.exe 85 PID 2828 wrote to memory of 1432 2828 bb6078c22a2c4498670dc0d4cabb218f_JaffaCakes118.exe 85 PID 2828 wrote to memory of 1432 2828 bb6078c22a2c4498670dc0d4cabb218f_JaffaCakes118.exe 85 PID 2828 wrote to memory of 1432 2828 bb6078c22a2c4498670dc0d4cabb218f_JaffaCakes118.exe 85 PID 2828 wrote to memory of 1432 2828 bb6078c22a2c4498670dc0d4cabb218f_JaffaCakes118.exe 85 PID 2828 wrote to memory of 1432 2828 bb6078c22a2c4498670dc0d4cabb218f_JaffaCakes118.exe 85 PID 2828 wrote to memory of 1432 2828 bb6078c22a2c4498670dc0d4cabb218f_JaffaCakes118.exe 85 PID 2828 wrote to memory of 1432 2828 bb6078c22a2c4498670dc0d4cabb218f_JaffaCakes118.exe 85 PID 2828 wrote to memory of 2492 2828 bb6078c22a2c4498670dc0d4cabb218f_JaffaCakes118.exe 87 PID 2828 wrote to memory of 2492 2828 bb6078c22a2c4498670dc0d4cabb218f_JaffaCakes118.exe 87 PID 2828 wrote to memory of 2492 2828 bb6078c22a2c4498670dc0d4cabb218f_JaffaCakes118.exe 87 PID 2492 wrote to memory of 4780 2492 cmd.exe 89 PID 2492 wrote to memory of 4780 2492 cmd.exe 89 PID 2492 wrote to memory of 4780 2492 cmd.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\bb6078c22a2c4498670dc0d4cabb218f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\bb6078c22a2c4498670dc0d4cabb218f_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1432
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del bb6078c22a2c4498670dc0d4cabb218f_JaffaCakes118.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4780
-
-