Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
20-09-2024 17:03
Static task
static1
Behavioral task
behavioral1
Sample
ee0b50bfe58e4bbbc51343ad57ad7700_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
ee0b50bfe58e4bbbc51343ad57ad7700_JaffaCakes118.exe
-
Size
181KB
-
MD5
ee0b50bfe58e4bbbc51343ad57ad7700
-
SHA1
5906c02563912ea4f7809d464d2c6c4dae9ad674
-
SHA256
ef85f1df03308b40716507203a71e1501ceb5ed5d71d74e1a089ddb8d5c0059d
-
SHA512
792f9b2c53aa7850ec90b138f9bce1bb969acb4794d9a90cb0c937531addc77508d8e99343bc2aa263296bb716e8dbc84df51f3ea105d7a0ae473dbbeb232683
-
SSDEEP
3072:KJKAjLvW7MmCSth5DZ03sOKIzY9lVlAXBNEcqgT2b6x:ji4MmRDy4yUiR
Malware Config
Signatures
-
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 scrntyp.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE scrntyp.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies scrntyp.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 scrntyp.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ee0b50bfe58e4bbbc51343ad57ad7700_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scrntyp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scrntyp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ee0b50bfe58e4bbbc51343ad57ad7700_JaffaCakes118.exe -
Modifies data under HKEY_USERS 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix scrntyp.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" scrntyp.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" scrntyp.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 3692 scrntyp.exe 3692 scrntyp.exe 3692 scrntyp.exe 3692 scrntyp.exe 3692 scrntyp.exe 3692 scrntyp.exe 3692 scrntyp.exe 3692 scrntyp.exe 3692 scrntyp.exe 3692 scrntyp.exe 3692 scrntyp.exe 3692 scrntyp.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1564 ee0b50bfe58e4bbbc51343ad57ad7700_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4324 wrote to memory of 1564 4324 ee0b50bfe58e4bbbc51343ad57ad7700_JaffaCakes118.exe 82 PID 4324 wrote to memory of 1564 4324 ee0b50bfe58e4bbbc51343ad57ad7700_JaffaCakes118.exe 82 PID 4324 wrote to memory of 1564 4324 ee0b50bfe58e4bbbc51343ad57ad7700_JaffaCakes118.exe 82 PID 3328 wrote to memory of 3692 3328 scrntyp.exe 86 PID 3328 wrote to memory of 3692 3328 scrntyp.exe 86 PID 3328 wrote to memory of 3692 3328 scrntyp.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee0b50bfe58e4bbbc51343ad57ad7700_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ee0b50bfe58e4bbbc51343ad57ad7700_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\ee0b50bfe58e4bbbc51343ad57ad7700_JaffaCakes118.exe--5ee4eb832⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
PID:1564
-
-
C:\Windows\SysWOW64\scrntyp.exe"C:\Windows\SysWOW64\scrntyp.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Windows\SysWOW64\scrntyp.exe--17d8d4352⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3692
-
Network
-
Remote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle
-
Remote address:8.8.8.8:53Request25.140.123.92.in-addr.arpaIN PTRResponse25.140.123.92.in-addr.arpaIN PTRa92-123-140-25deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request209.205.72.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request0.159.190.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request13.86.106.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request154.239.44.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request197.87.175.4.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request15.164.165.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request35.56.20.217.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request240.143.123.92.in-addr.arpaIN PTRResponse240.143.123.92.in-addr.arpaIN PTRa92-123-143-240deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request37.56.20.217.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request19.229.111.52.in-addr.arpaIN PTRResponse
-
260 B 5
-
260 B 5
-
260 B 5
-
260 B 5
-
260 B 5
-
66 B 90 B 1 1
DNS Request
8.8.8.8.in-addr.arpa
-
72 B 137 B 1 1
DNS Request
25.140.123.92.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
209.205.72.20.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
0.159.190.20.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
13.86.106.20.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
154.239.44.20.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
197.87.175.4.in-addr.arpa
-
72 B 146 B 1 1
DNS Request
15.164.165.52.in-addr.arpa
-
71 B 131 B 1 1
DNS Request
35.56.20.217.in-addr.arpa
-
73 B 139 B 1 1
DNS Request
240.143.123.92.in-addr.arpa
-
71 B 131 B 1 1
DNS Request
37.56.20.217.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
19.229.111.52.in-addr.arpa