Analysis
-
max time kernel
94s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25/08/2024, 10:09
Static task
static1
Behavioral task
behavioral1
Sample
c081fd598d958e659409a2c23f590767_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
c081fd598d958e659409a2c23f590767_JaffaCakes118.exe
-
Size
877KB
-
MD5
c081fd598d958e659409a2c23f590767
-
SHA1
03b953e60a1dfebfd195a195564249dc261233cf
-
SHA256
20b28f547abd38083ad2df49304ae7c1476f98fecb095ffba84e735e3f210aa9
-
SHA512
6d8b8da2e2109ce20b772e5d93b5c48046b6dd90b872a6aae7cdf4c586f31b1cc57ac2188c5b8363ab4546d539a182f7c7b735ef82337ce2f7960898ff15239f
-
SSDEEP
24576:BkMLKmtvPyHu7yCzAmiKv4y9pNg4W7HMoG3bOAHC5x:+iKmHyOrAcvip7snK
Malware Config
Signatures
-
Loads dropped DLL 6 IoCs
pid Process 2764 c081fd598d958e659409a2c23f590767_JaffaCakes118.exe 2764 c081fd598d958e659409a2c23f590767_JaffaCakes118.exe 2764 c081fd598d958e659409a2c23f590767_JaffaCakes118.exe 2764 c081fd598d958e659409a2c23f590767_JaffaCakes118.exe 2764 c081fd598d958e659409a2c23f590767_JaffaCakes118.exe 2764 c081fd598d958e659409a2c23f590767_JaffaCakes118.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA c081fd598d958e659409a2c23f590767_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c081fd598d958e659409a2c23f590767_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c081fd598d958e659409a2c23f590767_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c081fd598d958e659409a2c23f590767_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1480 wrote to memory of 4704 1480 c081fd598d958e659409a2c23f590767_JaffaCakes118.exe 86 PID 1480 wrote to memory of 4704 1480 c081fd598d958e659409a2c23f590767_JaffaCakes118.exe 86 PID 1480 wrote to memory of 4704 1480 c081fd598d958e659409a2c23f590767_JaffaCakes118.exe 86 PID 4704 wrote to memory of 2764 4704 c081fd598d958e659409a2c23f590767_JaffaCakes118.exe 87 PID 4704 wrote to memory of 2764 4704 c081fd598d958e659409a2c23f590767_JaffaCakes118.exe 87 PID 4704 wrote to memory of 2764 4704 c081fd598d958e659409a2c23f590767_JaffaCakes118.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c081fd598d958e659409a2c23f590767_JaffaCakes118.exe"3⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
PID:2764
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
73KB
MD560d3fe46288cd8cfb5ff7d06e285f335
SHA103d4cd2364321a82f8aea4c6c3ff12946c181c94
SHA256e5d6610f6f690a078eb33ced642ddc8c696e49509156ed3771b843cf69f5bc81
SHA512acaa04d8ce4acc1518c6f8a055539559f009fa5c0c39b16d3ccb232347ce960c688c2fe3fb8971448d5ea65fb10408dad51a602ee394046f6f6973915c6ec5cd
-
Filesize
5KB
MD544dac7f87bdf94d553f8d2cf073d605d
SHA121bf5d714b9fcab32ba40ff7d36e48c378b67a06
SHA2560e7dedad1360a808e7ab1086ff1fffa7b72f09475c07a6991b74a6c6b78ccf66
SHA51292c6bf81d514b3a07e7796843200a78c17969720776b03c0d347aeefedb8f1269f6aac642728a38544836c1f17c594d570718d11368dc91fe5194ee5e83e1774
-
Filesize
494KB
MD5f0c59526f8186eadaf2171b8fd2967c1
SHA18ffbe3e03d8139b50b41931c7b3360a0eebdb5cb
SHA2566e35d85fe4365e508adc7faffc4517c29177380c2ba420f02c2b9ee03103d3f6
SHA512dccd287c5f25cac346836e1140b743756178d01cd58539cf8fac12f7ae54d338bfb4364c650edb4d6018ef1f4065f7e9835d32fd608f8ae66c67a0ffd05e9854
-
Filesize
200KB
MD55e778c2e85d5e69dc954204c385a8675
SHA12fe5caf49a765d0b14bcb566ba42f4629a9b1cd1
SHA256e972766211090485d57f9fdb316c63d247a8a42028b9bcaf5439c2586ec8234a
SHA51214e2631d57e96885603f00c132627c8930509a510d45f49d75eb634e2537fc2a841aeeade74575290f5c677df046f1ffeffb9d5fb52652b33c9c591ce6e5db1b