Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
07-09-2024 08:45
Behavioral task
behavioral1
Sample
d188c64010292c6bc14b39300ea1b02c_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d188c64010292c6bc14b39300ea1b02c_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
d188c64010292c6bc14b39300ea1b02c_JaffaCakes118.exe
-
Size
37KB
-
MD5
d188c64010292c6bc14b39300ea1b02c
-
SHA1
9e528a712b392f06702474754b69dbc5464aa67a
-
SHA256
dac45e2cb36561bb596a193bcecda204897edc877d3b53d7f90afe00de985e35
-
SHA512
a080a35a1013e36c8606d8b9c4536bb7a4ba302999abfd36f05f3f42c97caaa8a2dbb9533ca91521255905c1fd8fbabfb2772299d3f43deefb082969030d453e
-
SSDEEP
384:dBjrUiS6L1G5k2gyk/8If5e/QUZSgKrAF+rMRTyN/0L+EcoinblneHQM3epzXpNR:zjz32bk/8IQYUZS7rM+rMRa8Nunlt
Malware Config
Signatures
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 1064 netsh.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation d188c64010292c6bc14b39300ea1b02c_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 1556 server.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d188c64010292c6bc14b39300ea1b02c_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: SeDebugPrivilege 1556 server.exe Token: 33 1556 server.exe Token: SeIncBasePriorityPrivilege 1556 server.exe Token: 33 1556 server.exe Token: SeIncBasePriorityPrivilege 1556 server.exe Token: 33 1556 server.exe Token: SeIncBasePriorityPrivilege 1556 server.exe Token: 33 1556 server.exe Token: SeIncBasePriorityPrivilege 1556 server.exe Token: 33 1556 server.exe Token: SeIncBasePriorityPrivilege 1556 server.exe Token: 33 1556 server.exe Token: SeIncBasePriorityPrivilege 1556 server.exe Token: 33 1556 server.exe Token: SeIncBasePriorityPrivilege 1556 server.exe Token: 33 1556 server.exe Token: SeIncBasePriorityPrivilege 1556 server.exe Token: 33 1556 server.exe Token: SeIncBasePriorityPrivilege 1556 server.exe Token: 33 1556 server.exe Token: SeIncBasePriorityPrivilege 1556 server.exe Token: 33 1556 server.exe Token: SeIncBasePriorityPrivilege 1556 server.exe Token: 33 1556 server.exe Token: SeIncBasePriorityPrivilege 1556 server.exe Token: 33 1556 server.exe Token: SeIncBasePriorityPrivilege 1556 server.exe Token: 33 1556 server.exe Token: SeIncBasePriorityPrivilege 1556 server.exe Token: 33 1556 server.exe Token: SeIncBasePriorityPrivilege 1556 server.exe Token: 33 1556 server.exe Token: SeIncBasePriorityPrivilege 1556 server.exe Token: 33 1556 server.exe Token: SeIncBasePriorityPrivilege 1556 server.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4508 wrote to memory of 1556 4508 d188c64010292c6bc14b39300ea1b02c_JaffaCakes118.exe 92 PID 4508 wrote to memory of 1556 4508 d188c64010292c6bc14b39300ea1b02c_JaffaCakes118.exe 92 PID 4508 wrote to memory of 1556 4508 d188c64010292c6bc14b39300ea1b02c_JaffaCakes118.exe 92 PID 1556 wrote to memory of 1064 1556 server.exe 95 PID 1556 wrote to memory of 1064 1556 server.exe 95 PID 1556 wrote to memory of 1064 1556 server.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\d188c64010292c6bc14b39300ea1b02c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d188c64010292c6bc14b39300ea1b02c_JaffaCakes118.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Users\Admin\AppData\Roaming\server.exe"C:\Users\Admin\AppData\Roaming\server.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:1064
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
37KB
MD5d188c64010292c6bc14b39300ea1b02c
SHA19e528a712b392f06702474754b69dbc5464aa67a
SHA256dac45e2cb36561bb596a193bcecda204897edc877d3b53d7f90afe00de985e35
SHA512a080a35a1013e36c8606d8b9c4536bb7a4ba302999abfd36f05f3f42c97caaa8a2dbb9533ca91521255905c1fd8fbabfb2772299d3f43deefb082969030d453e