Analysis
-
max time kernel
147s -
max time network
115s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
08-09-2024 08:38
Static task
static1
Behavioral task
behavioral1
Sample
d3f6e294897bbe707073b6711a7ed10a_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d3f6e294897bbe707073b6711a7ed10a_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
d3f6e294897bbe707073b6711a7ed10a_JaffaCakes118.exe
-
Size
188KB
-
MD5
d3f6e294897bbe707073b6711a7ed10a
-
SHA1
641346b45971698f552edacccc0f5c8029605fc7
-
SHA256
53c5366e9c8e85bf7c05fef9fd7a568c29f1873d240c66d1e1c09674f74a2441
-
SHA512
4e81a3552909e9ea15e4e49de3625a12312dd018c09bac6110d1687f801937898c44aec86e788cabaf7d4cc76218c1f556f4a4ea5ef3014eec41a112677a05b1
-
SSDEEP
3072:/pchaupnL19s4gk5aDITxNC7fww+OCH9ABON5Cb5X6Rx:mbn7MITxBFndABEkbR6
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation d3f6e294897bbe707073b6711a7ed10a_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 1416 HDC.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\KLGmkG = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsyncs\\HDC.exe\"" d3f6e294897bbe707073b6711a7ed10a_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\KLGmkG = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsyncs\\HDC.exe\"" HDC.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1416 set thread context of 3408 1416 HDC.exe 97 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d3f6e294897bbe707073b6711a7ed10a_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HDC.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 4484 PING.EXE -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 4484 PING.EXE -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 224 d3f6e294897bbe707073b6711a7ed10a_JaffaCakes118.exe 224 d3f6e294897bbe707073b6711a7ed10a_JaffaCakes118.exe 1416 HDC.exe 1416 HDC.exe -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 224 d3f6e294897bbe707073b6711a7ed10a_JaffaCakes118.exe 224 d3f6e294897bbe707073b6711a7ed10a_JaffaCakes118.exe 1416 HDC.exe 1416 HDC.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 224 d3f6e294897bbe707073b6711a7ed10a_JaffaCakes118.exe 1416 HDC.exe 1416 HDC.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 224 wrote to memory of 1000 224 d3f6e294897bbe707073b6711a7ed10a_JaffaCakes118.exe 86 PID 224 wrote to memory of 1000 224 d3f6e294897bbe707073b6711a7ed10a_JaffaCakes118.exe 86 PID 224 wrote to memory of 1000 224 d3f6e294897bbe707073b6711a7ed10a_JaffaCakes118.exe 86 PID 1000 wrote to memory of 4484 1000 cmd.exe 88 PID 1000 wrote to memory of 4484 1000 cmd.exe 88 PID 1000 wrote to memory of 4484 1000 cmd.exe 88 PID 1000 wrote to memory of 1416 1000 cmd.exe 89 PID 1000 wrote to memory of 1416 1000 cmd.exe 89 PID 1000 wrote to memory of 1416 1000 cmd.exe 89 PID 1416 wrote to memory of 3408 1416 HDC.exe 97 PID 1416 wrote to memory of 3408 1416 HDC.exe 97 PID 1416 wrote to memory of 3408 1416 HDC.exe 97 PID 1416 wrote to memory of 3408 1416 HDC.exe 97 PID 1416 wrote to memory of 3408 1416 HDC.exe 97 PID 1416 wrote to memory of 3408 1416 HDC.exe 97 PID 1416 wrote to memory of 3408 1416 HDC.exe 97 PID 1416 wrote to memory of 3408 1416 HDC.exe 97 PID 1416 wrote to memory of 3408 1416 HDC.exe 97 PID 1416 wrote to memory of 3408 1416 HDC.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\d3f6e294897bbe707073b6711a7ed10a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d3f6e294897bbe707073b6711a7ed10a_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Windows\SysWOW64\PING.EXEPING 127.0.0.1 -n 23⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4484
-
-
C:\Users\Admin\AppData\Roaming\Microsyncs\HDC.exe"C:\Users\Admin\AppData\Roaming\Microsyncs\HDC.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe4⤵PID:3408
-
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
100B
MD5b355235f831a1dc7d370c450c1f97e98
SHA1aa60c9caaf83297f5f636dffb4f98b98737e7c18
SHA2569164847d47eb56e5eef7742cfb589f3da06ac3d0d54d02adad80430944ac4ed4
SHA5121439c040286f82da0fe8e0bacdd1dfd2d37782a4d012a2d19175e861f8db6b17eecab1f118b26bbab69fb76164ae98cb8b62a549e558adcfcc0e18a8cca5fba5
-
Filesize
188KB
MD5d3f6e294897bbe707073b6711a7ed10a
SHA1641346b45971698f552edacccc0f5c8029605fc7
SHA25653c5366e9c8e85bf7c05fef9fd7a568c29f1873d240c66d1e1c09674f74a2441
SHA5124e81a3552909e9ea15e4e49de3625a12312dd018c09bac6110d1687f801937898c44aec86e788cabaf7d4cc76218c1f556f4a4ea5ef3014eec41a112677a05b1