Analysis
-
max time kernel
93s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
18-09-2024 22:14
Static task
static1
Behavioral task
behavioral1
Sample
ea10af19bcfc45e4054a8583a9cfb4d2_JaffaCakes118.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral2
Sample
ea10af19bcfc45e4054a8583a9cfb4d2_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
General
-
Target
ea10af19bcfc45e4054a8583a9cfb4d2_JaffaCakes118.exe
-
Size
45.1MB
-
MD5
ea10af19bcfc45e4054a8583a9cfb4d2
-
SHA1
93c5151b0aea4c18034e235b44e69602342b6d23
-
SHA256
20779d3a0954a00965e2c969406ff3596d6b60ea6d04be4ced377ffa5e7b22ac
-
SHA512
69ef2806a2e55aa15f1f0c7dc7609167c0479f54a9a9e5377fa3d35e6fe1f066b1e45a719c6f9c4e8753a91b11da8f2c30acffa0a5365fde35222412e1c24f5b
-
SSDEEP
786432:Dzu5xn34JpxDBD5FGx9WGtVdj4H0pBXE1ByI3gdjorY/Hn95L2OIBT9AS:+z32xDBD5gx8GZnAByW6Hje
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation ea10af19bcfc45e4054a8583a9cfb4d2_JaffaCakes118.exe -
Loads dropped DLL 4 IoCs
pid Process 1568 MsiExec.exe 1568 MsiExec.exe 1568 MsiExec.exe 1568 MsiExec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\N: msiexec.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\Wise Installation Wizard\WIS1F7E4FF9D2E542589AE1E16E6CB3252A_4_17_6_4336.MSI ea10af19bcfc45e4054a8583a9cfb4d2_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Wise Installation Wizard\WIS1F7E4FF9D2E542589AE1E16E6CB3252A_4_17_6_4336.MSI ea10af19bcfc45e4054a8583a9cfb4d2_JaffaCakes118.exe -
Drops file in Windows directory 9 IoCs
description ioc Process File created C:\Windows\1F7E4FF9D2E542589AE1E16E6CB3252A.TMP\WiseCustomCalla21.dll MsiExec.exe File created C:\Windows\1F7E4FF9D2E542589AE1E16E6CB3252A.TMP\WiseCustomCall.dll MsiExec.exe File created C:\Windows\1F7E4FF9D2E542589AE1E16E6CB3252A.TMP\WiseCustomCalla.dll MsiExec.exe File created C:\Windows\1F7E4FF9D2E542589AE1E16E6CB3252A.TMP\WiseCustomCalla31.dll MsiExec.exe File created C:\Windows\1F7E4FF9D2E542589AE1E16E6CB3252A.TMP\WiseCustomCalla33.dll MsiExec.exe File created C:\Windows\1F7E4FF9D2E542589AE1E16E6CB3252A.TMP\WiseCustomCalla34.dll MsiExec.exe File created C:\Windows\1F7E4FF9D2E542589AE1E16E6CB3252A.TMP\WiseCustomCalla36.dll MsiExec.exe File created C:\Windows\1F7E4FF9D2E542589AE1E16E6CB3252A.TMP\WiseCustomCalla2.dll MsiExec.exe File created C:\Windows\1F7E4FF9D2E542589AE1E16E6CB3252A.TMP\WiseCustomCalla32.dll MsiExec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ea10af19bcfc45e4054a8583a9cfb4d2_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1116 msiexec.exe Token: SeIncreaseQuotaPrivilege 1116 msiexec.exe Token: SeSecurityPrivilege 2036 msiexec.exe Token: SeCreateTokenPrivilege 1116 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1116 msiexec.exe Token: SeLockMemoryPrivilege 1116 msiexec.exe Token: SeIncreaseQuotaPrivilege 1116 msiexec.exe Token: SeMachineAccountPrivilege 1116 msiexec.exe Token: SeTcbPrivilege 1116 msiexec.exe Token: SeSecurityPrivilege 1116 msiexec.exe Token: SeTakeOwnershipPrivilege 1116 msiexec.exe Token: SeLoadDriverPrivilege 1116 msiexec.exe Token: SeSystemProfilePrivilege 1116 msiexec.exe Token: SeSystemtimePrivilege 1116 msiexec.exe Token: SeProfSingleProcessPrivilege 1116 msiexec.exe Token: SeIncBasePriorityPrivilege 1116 msiexec.exe Token: SeCreatePagefilePrivilege 1116 msiexec.exe Token: SeCreatePermanentPrivilege 1116 msiexec.exe Token: SeBackupPrivilege 1116 msiexec.exe Token: SeRestorePrivilege 1116 msiexec.exe Token: SeShutdownPrivilege 1116 msiexec.exe Token: SeDebugPrivilege 1116 msiexec.exe Token: SeAuditPrivilege 1116 msiexec.exe Token: SeSystemEnvironmentPrivilege 1116 msiexec.exe Token: SeChangeNotifyPrivilege 1116 msiexec.exe Token: SeRemoteShutdownPrivilege 1116 msiexec.exe Token: SeUndockPrivilege 1116 msiexec.exe Token: SeSyncAgentPrivilege 1116 msiexec.exe Token: SeEnableDelegationPrivilege 1116 msiexec.exe Token: SeManageVolumePrivilege 1116 msiexec.exe Token: SeImpersonatePrivilege 1116 msiexec.exe Token: SeCreateGlobalPrivilege 1116 msiexec.exe Token: SeCreateTokenPrivilege 1116 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1116 msiexec.exe Token: SeLockMemoryPrivilege 1116 msiexec.exe Token: SeIncreaseQuotaPrivilege 1116 msiexec.exe Token: SeMachineAccountPrivilege 1116 msiexec.exe Token: SeTcbPrivilege 1116 msiexec.exe Token: SeSecurityPrivilege 1116 msiexec.exe Token: SeTakeOwnershipPrivilege 1116 msiexec.exe Token: SeLoadDriverPrivilege 1116 msiexec.exe Token: SeSystemProfilePrivilege 1116 msiexec.exe Token: SeSystemtimePrivilege 1116 msiexec.exe Token: SeProfSingleProcessPrivilege 1116 msiexec.exe Token: SeIncBasePriorityPrivilege 1116 msiexec.exe Token: SeCreatePagefilePrivilege 1116 msiexec.exe Token: SeCreatePermanentPrivilege 1116 msiexec.exe Token: SeBackupPrivilege 1116 msiexec.exe Token: SeRestorePrivilege 1116 msiexec.exe Token: SeShutdownPrivilege 1116 msiexec.exe Token: SeDebugPrivilege 1116 msiexec.exe Token: SeAuditPrivilege 1116 msiexec.exe Token: SeSystemEnvironmentPrivilege 1116 msiexec.exe Token: SeChangeNotifyPrivilege 1116 msiexec.exe Token: SeRemoteShutdownPrivilege 1116 msiexec.exe Token: SeUndockPrivilege 1116 msiexec.exe Token: SeSyncAgentPrivilege 1116 msiexec.exe Token: SeEnableDelegationPrivilege 1116 msiexec.exe Token: SeManageVolumePrivilege 1116 msiexec.exe Token: SeImpersonatePrivilege 1116 msiexec.exe Token: SeCreateGlobalPrivilege 1116 msiexec.exe Token: SeCreateTokenPrivilege 1116 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1116 msiexec.exe Token: SeLockMemoryPrivilege 1116 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1116 msiexec.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3456 wrote to memory of 1116 3456 ea10af19bcfc45e4054a8583a9cfb4d2_JaffaCakes118.exe 87 PID 3456 wrote to memory of 1116 3456 ea10af19bcfc45e4054a8583a9cfb4d2_JaffaCakes118.exe 87 PID 3456 wrote to memory of 1116 3456 ea10af19bcfc45e4054a8583a9cfb4d2_JaffaCakes118.exe 87 PID 2036 wrote to memory of 1568 2036 msiexec.exe 90 PID 2036 wrote to memory of 1568 2036 msiexec.exe 90 PID 2036 wrote to memory of 1568 2036 msiexec.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\ea10af19bcfc45e4054a8583a9cfb4d2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ea10af19bcfc45e4054a8583a9cfb4d2_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /I "C:\Program Files (x86)\Common Files\Wise Installation Wizard\WIS1F7E4FF9D2E542589AE1E16E6CB3252A_4_17_6_4336.MSI" WISE_SETUP_EXE_PATH="C:\Users\Admin\AppData\Local\Temp\ea10af19bcfc45e4054a8583a9cfb4d2_JaffaCakes118.exe"2⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1116
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 7730523A3A7D43A14EBE3318B20368F8 C2⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1568
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Common Files\Wise Installation Wizard\WIS1F7E4FF9D2E542589AE1E16E6CB3252A_4_17_6_4336.MSI
Filesize44.3MB
MD5691ccff02b1df29094dc4aaabcfd59ea
SHA120a4946a1800692fd777d6392452ca5e2d89b1f5
SHA25659f22b3b74fb02c319284a50f3b45d7f5aa285feecf3e4c084a8b8d15b82c936
SHA512074d2c0934818c9562bb6e0df5403fb9e3edb5bbf71cbfa9dcb766d9130e9e9b123e022ee6a85447b14736fa1c4095020e3d94f2681a15912656b38ee7f6b225
-
Filesize
65KB
MD5b02eeaca3a0950659793dd40e1ca44ec
SHA1d607b42701cea0504afd3e172dfb9df732e67ba0
SHA2564cad23ae1201f4311d73b08d72dedca157c8dd587ed1d44be96b9c5149e494da
SHA512f744aefa8b567cce3bc13994f71434b75d299714c8fc6a157b17e364d0c6c771ed5a1dd3646a715303d3f519a5c76c53ac37a1714a04ff74d94c364efed399a7
-
Filesize
238KB
MD5792953a279efde80e70561e5fa2fe5d2
SHA1c91b6612145f96cc3fd1c7b12736427d4ea7df00
SHA256bb67895f98f5dedd9090ec8f5476b998e353b8ed444c225dfd6fc06e6939cb89
SHA5129fad635f819aad740bb6b72e5e2c293ffe217e3e54ca43c864139e3e83d272dfffbf8ebe9fa02ee00e690a04aa6728180ae89e15a599aa3f310a53bb1c34e149
-
Filesize
13KB
MD5b5dee73421d4c156143371161173bc3f
SHA1835fd4e746515485ac6baad4273c587d13e24ccd
SHA256d3be2427ca4d43d08c8a8f7575c2b0748092e52f4a976f894746f962ca977841
SHA5124888d5dcba735cdf9a4e041af99f443c082f96d9a7ac5f8d45be1a547b654459e35fbb75c117b4c0019f6bc42874653e9594bb1c4191986b0de5b1658a55cfaa
-
Filesize
172KB
MD56256cd1a5ade17263eb0aa0758e576a4
SHA1c2b0be38589d87dd5f298df3a503d2482bf83752
SHA2563dc8037115ba3a280b291d62f6c722d6c881d462908bef338920371938d5eb4f
SHA512947f29ea9e9f64bc2b3c6b8ccd26ac248ad5febef57ebbae0d59b8764e9c155112e0debc6dc0f95dbedf6ff8e4e75b9caf5c5268c56f21db77a528a8d27deeba