Analysis
-
max time kernel
95s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
08/09/2024, 00:07
Static task
static1
Behavioral task
behavioral1
Sample
d31ce4cfca926c4f12621dd0aacad529_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d31ce4cfca926c4f12621dd0aacad529_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
d31ce4cfca926c4f12621dd0aacad529_JaffaCakes118.exe
-
Size
76KB
-
MD5
d31ce4cfca926c4f12621dd0aacad529
-
SHA1
e2fd9c90c90fc309f2dec8d4258bebab67dd3603
-
SHA256
cd36ef7a96ac3ea6cf6c7c9ddd32cf52afe359685d4a362f1140e148d8d47dd9
-
SHA512
c292bbece03706d8b9d3cd89b2469620ff8e9d805c9e6ea4e7f5f7595d5ad677dbb41e7700f8545694bcaf5e89ae986f2a078a2d96b68cf85146624fc7da5098
-
SSDEEP
1536:Xn/oYXOzjiNs5ng9JvzY7qQvjJqBli0wY7kM+ia0NSYo:X/oNng76vjUji0wY7kga0NSYo
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation d31ce4cfca926c4f12621dd0aacad529_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 4508 update.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\WINDOWS\Fonts\1.ho d31ce4cfca926c4f12621dd0aacad529_JaffaCakes118.exe File opened for modification C:\WINDOWS\Fonts\update.exe d31ce4cfca926c4f12621dd0aacad529_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d31ce4cfca926c4f12621dd0aacad529_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4488 d31ce4cfca926c4f12621dd0aacad529_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4488 wrote to memory of 1548 4488 d31ce4cfca926c4f12621dd0aacad529_JaffaCakes118.exe 84 PID 4488 wrote to memory of 1548 4488 d31ce4cfca926c4f12621dd0aacad529_JaffaCakes118.exe 84 PID 4488 wrote to memory of 1548 4488 d31ce4cfca926c4f12621dd0aacad529_JaffaCakes118.exe 84 PID 1548 wrote to memory of 1800 1548 cmd.exe 87 PID 1548 wrote to memory of 1800 1548 cmd.exe 87 PID 1548 wrote to memory of 1800 1548 cmd.exe 87 PID 1800 wrote to memory of 1292 1800 net.exe 88 PID 1800 wrote to memory of 1292 1800 net.exe 88 PID 1800 wrote to memory of 1292 1800 net.exe 88 PID 4488 wrote to memory of 4508 4488 d31ce4cfca926c4f12621dd0aacad529_JaffaCakes118.exe 95 PID 4488 wrote to memory of 4508 4488 d31ce4cfca926c4f12621dd0aacad529_JaffaCakes118.exe 95 PID 4488 wrote to memory of 4508 4488 d31ce4cfca926c4f12621dd0aacad529_JaffaCakes118.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\d31ce4cfca926c4f12621dd0aacad529_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d31ce4cfca926c4f12621dd0aacad529_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c net stop sharedaccess2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Windows\SysWOW64\net.exenet stop sharedaccess3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess4⤵
- System Location Discovery: System Language Discovery
PID:1292
-
-
-
-
C:\WINDOWS\Fonts\update.exe"C:\WINDOWS\Fonts\update.exe"2⤵
- Executes dropped EXE
PID:4508
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13KB
MD58bc53dbc89bf00c17078c483fc6197c5
SHA1ce27007d05bfde17b3a10cc720e3c1e8a0149c2c
SHA256991d6f5164315870e107ab3c3718feaf1a763fb2a7898d725e63ad8bd829c7b1
SHA5127444dec3fbe2d3a2bde114c7a377b640ff9aac8d798caa833e297b68112d2e8e8bbafe54c5da0bda84678404a74ebf5894f268ff9510b57f131726a39ef274dc