Analysis
-
max time kernel
140s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
12/09/2024, 10:03
Static task
static1
Behavioral task
behavioral1
Sample
dc2f59de5c5f5b0cd4766aea86d3a5e3_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
dc2f59de5c5f5b0cd4766aea86d3a5e3_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
dc2f59de5c5f5b0cd4766aea86d3a5e3_JaffaCakes118.exe
-
Size
130KB
-
MD5
dc2f59de5c5f5b0cd4766aea86d3a5e3
-
SHA1
2eb23ed0f3bcebd4634a868b3971ac48bcb6aea0
-
SHA256
d6561c2e624739bea824f79b1530737945cc5d4feb8455816420d000184b60ad
-
SHA512
f68c6e1310777a37e1b3ff490ba790ad6a39f40b99df9e62f43b6f3437b1e611610517d43663f0a586094a4307b031134c57f535cb3a6e7dff4651f38ad2aeaa
-
SSDEEP
3072:Q6DvC3rYnl6KkHlMyr1CFIXTiYQlz5xDddPOQIl8QP1s:Q6DvBXVg1CYCPxdPclPds
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation dc2f59de5c5f5b0cd4766aea86d3a5e3_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 4816 lmg.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\lmg.exe dc2f59de5c5f5b0cd4766aea86d3a5e3_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dc2f59de5c5f5b0cd4766aea86d3a5e3_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lmg.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1200 dc2f59de5c5f5b0cd4766aea86d3a5e3_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1200 wrote to memory of 4816 1200 dc2f59de5c5f5b0cd4766aea86d3a5e3_JaffaCakes118.exe 85 PID 1200 wrote to memory of 4816 1200 dc2f59de5c5f5b0cd4766aea86d3a5e3_JaffaCakes118.exe 85 PID 1200 wrote to memory of 4816 1200 dc2f59de5c5f5b0cd4766aea86d3a5e3_JaffaCakes118.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\dc2f59de5c5f5b0cd4766aea86d3a5e3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\dc2f59de5c5f5b0cd4766aea86d3a5e3_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Windows\lmg.exe"C:\Windows\lmg.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4816
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
114KB
MD5be7ac462ec7726aa87126e15a691e011
SHA13d6056b4d25a068618a7256c8b37d60df6b15cdc
SHA256fccba5786fe3aea68a805086843d94c07c266e01c268b92b95f1a0bcf8ba7bf2
SHA5121d146de234d62f2342b8cae7c67a38e01d7baee52cbbbac48354b2a859f5178d09d1ffe4906124015897600da4194d74d77d692a5be408a78d8e154b04d7ef68