Analysis
-
max time kernel
150s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
11/09/2024, 13:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
da6786d4323339c99e631c43d6a95764_JaffaCakes118.exe
Resource
win7-20240729-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
da6786d4323339c99e631c43d6a95764_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
da6786d4323339c99e631c43d6a95764_JaffaCakes118.exe
-
Size
615KB
-
MD5
da6786d4323339c99e631c43d6a95764
-
SHA1
32939704cb6c5e10d0bfe36a34f1b2fd06abad7e
-
SHA256
8e4fef2e7850fd1ce73edd2e5a5bca00f36ad8b9e4bf68e514daaffd6a54731e
-
SHA512
3f0a835bc5d3327f7c3d89d20330ab49335a9b5195a378dfa5e9f604dfb5b66af178f1aa4a51346bcf942a581977a9640a72b20683151d624ef201da1c901d9d
-
SSDEEP
12288:KaJYEoUmZS6VqK6fECF/nedEXqKCURbxlgeMHCina8x0qQYXlJq5fwSL8Z:K2nKh6fEWnedCDt+yMKE1Jp48Z
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation da6786d4323339c99e631c43d6a95764_JaffaCakes118.exe -
Executes dropped EXE 2 IoCs
pid Process 3692 SVCHOST.EXE 2212 Pinnacle.exe -
resource yara_rule behavioral2/files/0x00090000000235e4-15.dat upx behavioral2/memory/2212-23-0x0000000000400000-0x00000000004A4000-memory.dmp upx behavioral2/memory/2212-31-0x0000000000400000-0x00000000004A4000-memory.dmp upx behavioral2/memory/2212-45-0x0000000000400000-0x00000000004A4000-memory.dmp upx behavioral2/memory/2212-51-0x0000000000400000-0x00000000004A4000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SVCHOST = "c:\\windows\\SVCHOST.EXE" da6786d4323339c99e631c43d6a95764_JaffaCakes118.exe -
AutoIT Executable 3 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/2212-31-0x0000000000400000-0x00000000004A4000-memory.dmp autoit_exe behavioral2/memory/2212-45-0x0000000000400000-0x00000000004A4000-memory.dmp autoit_exe behavioral2/memory/2212-51-0x0000000000400000-0x00000000004A4000-memory.dmp autoit_exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created \??\c:\windows\svchost.inf da6786d4323339c99e631c43d6a95764_JaffaCakes118.exe File created \??\c:\windows\SVCHOST.EXE da6786d4323339c99e631c43d6a95764_JaffaCakes118.exe File created \??\c:\windows\Pinnacle.exe da6786d4323339c99e631c43d6a95764_JaffaCakes118.exe File opened for modification \??\c:\windows\svchost.inf SVCHOST.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 3836 1424 WerFault.exe 87 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pinnacle.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language da6786d4323339c99e631c43d6a95764_JaffaCakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2212 Pinnacle.exe 3692 SVCHOST.EXE -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe 2212 Pinnacle.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3692 SVCHOST.EXE -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1424 wrote to memory of 3692 1424 da6786d4323339c99e631c43d6a95764_JaffaCakes118.exe 94 PID 1424 wrote to memory of 3692 1424 da6786d4323339c99e631c43d6a95764_JaffaCakes118.exe 94 PID 1424 wrote to memory of 3692 1424 da6786d4323339c99e631c43d6a95764_JaffaCakes118.exe 94 PID 1424 wrote to memory of 2212 1424 da6786d4323339c99e631c43d6a95764_JaffaCakes118.exe 95 PID 1424 wrote to memory of 2212 1424 da6786d4323339c99e631c43d6a95764_JaffaCakes118.exe 95 PID 1424 wrote to memory of 2212 1424 da6786d4323339c99e631c43d6a95764_JaffaCakes118.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\da6786d4323339c99e631c43d6a95764_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\da6786d4323339c99e631c43d6a95764_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1424 -s 2762⤵
- Program crash
PID:3836
-
-
C:\windows\SVCHOST.EXE"C:\windows\SVCHOST.EXE"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3692
-
-
C:\windows\Pinnacle.exe"C:\windows\Pinnacle.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2212
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1424 -ip 14241⤵PID:1504
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4292,i,12470628711992022444,7767535593390851522,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:81⤵PID:896
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
261KB
MD5b2755b1b19afb6f091b95a04fcfc7e32
SHA113bb01e2c504b1d76ad20931c33bf1361b8a07e8
SHA2568ec3c7cc0cade861b181c9ebe19b970ee5bdad92cc50d1fc5de8bcc1b3b831ac
SHA5120ee56aa01f3861179aed1790b2ac619c3b0e03ceda4e188fdced6b49c5f9e7d3bbc510f54e8e7b69dcaee2f92594d9e536982e4e5bd4eda5763941651661669e
-
Filesize
500KB
MD50cdc7a7f8804f6cdc41ced97605a8613
SHA1975a9c0a7607345f2bb92e6b534bafca1a58e779
SHA256386b1a18f4fe8962990cc021bd0dd3e75e4ed613d7cc0ae7093ed534a9ec3d2f
SHA5128987592798d0cd8a249dce2836ae822a53ca57595fe801ca3ced840892b539546267bd95e7e54de0c9c49f427ae8742ac8f699daabc64bcfae21a37f7203f563
-
Filesize
3B
MD5a5ea0ad9260b1550a14cc58d2c39b03d
SHA1f0aedf295071ed34ab8c6a7692223d22b6a19841
SHA256f1b2f662800122bed0ff255693df89c4487fbdcf453d3524a42d4ec20c3d9c04
SHA5127c735c613ece191801114785c1ee26a0485cbf1e8ee2c3b85ba1ad290ef75eec9fede5e1a5dc26d504701f3542e6b6457818f4c1d62448d0db40d5f35c357d74