Analysis
-
max time kernel
148s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
30/09/2024, 17:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
028a372b6824baeda7c68457ed544458_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
028a372b6824baeda7c68457ed544458_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
028a372b6824baeda7c68457ed544458_JaffaCakes118.exe
-
Size
132KB
-
MD5
028a372b6824baeda7c68457ed544458
-
SHA1
c62f0b1274c4d85df1663f7a18b3ffc5138d86ed
-
SHA256
95cc38f9960a3cff8ec30454cbeedae1cbefa8ea808fbc8b312335f2b3d5c2f7
-
SHA512
1365ebc6daa00fcfa484dafe002b6d4562fd6d451d66cdbb4123d0bbe460f8b65d325ef7b93eef619d4e322ec95fe38657b71375b0a1b21186d5a33a8f423c71
-
SSDEEP
1536:bHFjwOqUuflO+6peVdM/d2yv6n0APB8qFE0OSqHW2PYoPPrCLaC46lxIDCwMZOD7:ryOqxY+6pejzNB8A4xAo784KmMMDLH
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2024 indiagamcaa.exe 2936 indiagamcaa.exe -
Loads dropped DLL 5 IoCs
pid Process 340 028a372b6824baeda7c68457ed544458_JaffaCakes118.exe 340 028a372b6824baeda7c68457ed544458_JaffaCakes118.exe 340 028a372b6824baeda7c68457ed544458_JaffaCakes118.exe 340 028a372b6824baeda7c68457ed544458_JaffaCakes118.exe 340 028a372b6824baeda7c68457ed544458_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\indiagamcaaa = "C:\\Users\\Admin\\AppData\\Roaming\\india gamcaa\\indiagamcaa.exe" reg.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1600 set thread context of 340 1600 028a372b6824baeda7c68457ed544458_JaffaCakes118.exe 30 PID 2024 set thread context of 2936 2024 indiagamcaa.exe 36 PID 2024 set thread context of 0 2024 indiagamcaa.exe -
resource yara_rule behavioral1/memory/340-197-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/340-453-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/2936-457-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/2936-459-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 028a372b6824baeda7c68457ed544458_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 028a372b6824baeda7c68457ed544458_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indiagamcaa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indiagamcaa.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2936 indiagamcaa.exe Token: SeDebugPrivilege 2936 indiagamcaa.exe Token: SeDebugPrivilege 2936 indiagamcaa.exe Token: SeDebugPrivilege 2936 indiagamcaa.exe Token: SeDebugPrivilege 2936 indiagamcaa.exe Token: SeDebugPrivilege 2936 indiagamcaa.exe Token: SeDebugPrivilege 2936 indiagamcaa.exe Token: SeDebugPrivilege 2936 indiagamcaa.exe Token: SeDebugPrivilege 2936 indiagamcaa.exe Token: SeDebugPrivilege 2936 indiagamcaa.exe Token: SeDebugPrivilege 2936 indiagamcaa.exe Token: SeDebugPrivilege 2936 indiagamcaa.exe Token: SeDebugPrivilege 2936 indiagamcaa.exe Token: SeDebugPrivilege 2936 indiagamcaa.exe Token: SeDebugPrivilege 2936 indiagamcaa.exe Token: SeDebugPrivilege 2936 indiagamcaa.exe Token: SeDebugPrivilege 2936 indiagamcaa.exe Token: SeDebugPrivilege 2936 indiagamcaa.exe Token: SeDebugPrivilege 2936 indiagamcaa.exe Token: SeDebugPrivilege 2936 indiagamcaa.exe Token: SeDebugPrivilege 2936 indiagamcaa.exe Token: SeDebugPrivilege 2936 indiagamcaa.exe Token: SeDebugPrivilege 2936 indiagamcaa.exe Token: SeDebugPrivilege 2936 indiagamcaa.exe Token: SeDebugPrivilege 2936 indiagamcaa.exe Token: SeDebugPrivilege 2936 indiagamcaa.exe Token: SeDebugPrivilege 2936 indiagamcaa.exe Token: SeDebugPrivilege 2936 indiagamcaa.exe Token: SeDebugPrivilege 2936 indiagamcaa.exe Token: SeDebugPrivilege 2936 indiagamcaa.exe Token: SeDebugPrivilege 2936 indiagamcaa.exe Token: SeDebugPrivilege 2936 indiagamcaa.exe Token: SeDebugPrivilege 2936 indiagamcaa.exe Token: SeDebugPrivilege 2936 indiagamcaa.exe Token: SeDebugPrivilege 2936 indiagamcaa.exe Token: SeDebugPrivilege 2936 indiagamcaa.exe Token: SeDebugPrivilege 2936 indiagamcaa.exe Token: SeDebugPrivilege 2936 indiagamcaa.exe Token: SeDebugPrivilege 2936 indiagamcaa.exe Token: SeDebugPrivilege 2936 indiagamcaa.exe Token: SeDebugPrivilege 2936 indiagamcaa.exe Token: SeDebugPrivilege 2936 indiagamcaa.exe Token: SeDebugPrivilege 2936 indiagamcaa.exe Token: SeDebugPrivilege 2936 indiagamcaa.exe Token: SeDebugPrivilege 2936 indiagamcaa.exe Token: SeDebugPrivilege 2936 indiagamcaa.exe Token: SeDebugPrivilege 2936 indiagamcaa.exe Token: SeDebugPrivilege 2936 indiagamcaa.exe Token: SeDebugPrivilege 2936 indiagamcaa.exe Token: SeDebugPrivilege 2936 indiagamcaa.exe Token: SeDebugPrivilege 2936 indiagamcaa.exe Token: SeDebugPrivilege 2936 indiagamcaa.exe Token: SeDebugPrivilege 2936 indiagamcaa.exe Token: SeDebugPrivilege 2936 indiagamcaa.exe Token: SeDebugPrivilege 2936 indiagamcaa.exe Token: SeDebugPrivilege 2936 indiagamcaa.exe Token: SeDebugPrivilege 2936 indiagamcaa.exe Token: SeDebugPrivilege 2936 indiagamcaa.exe Token: SeDebugPrivilege 2936 indiagamcaa.exe Token: SeDebugPrivilege 2936 indiagamcaa.exe Token: SeDebugPrivilege 2936 indiagamcaa.exe Token: SeDebugPrivilege 2936 indiagamcaa.exe Token: SeDebugPrivilege 2936 indiagamcaa.exe Token: SeDebugPrivilege 2936 indiagamcaa.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1600 028a372b6824baeda7c68457ed544458_JaffaCakes118.exe 340 028a372b6824baeda7c68457ed544458_JaffaCakes118.exe 2024 indiagamcaa.exe 2936 indiagamcaa.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 1600 wrote to memory of 340 1600 028a372b6824baeda7c68457ed544458_JaffaCakes118.exe 30 PID 1600 wrote to memory of 340 1600 028a372b6824baeda7c68457ed544458_JaffaCakes118.exe 30 PID 1600 wrote to memory of 340 1600 028a372b6824baeda7c68457ed544458_JaffaCakes118.exe 30 PID 1600 wrote to memory of 340 1600 028a372b6824baeda7c68457ed544458_JaffaCakes118.exe 30 PID 1600 wrote to memory of 340 1600 028a372b6824baeda7c68457ed544458_JaffaCakes118.exe 30 PID 1600 wrote to memory of 340 1600 028a372b6824baeda7c68457ed544458_JaffaCakes118.exe 30 PID 1600 wrote to memory of 340 1600 028a372b6824baeda7c68457ed544458_JaffaCakes118.exe 30 PID 1600 wrote to memory of 340 1600 028a372b6824baeda7c68457ed544458_JaffaCakes118.exe 30 PID 340 wrote to memory of 2420 340 028a372b6824baeda7c68457ed544458_JaffaCakes118.exe 32 PID 340 wrote to memory of 2420 340 028a372b6824baeda7c68457ed544458_JaffaCakes118.exe 32 PID 340 wrote to memory of 2420 340 028a372b6824baeda7c68457ed544458_JaffaCakes118.exe 32 PID 340 wrote to memory of 2420 340 028a372b6824baeda7c68457ed544458_JaffaCakes118.exe 32 PID 2420 wrote to memory of 1952 2420 cmd.exe 34 PID 2420 wrote to memory of 1952 2420 cmd.exe 34 PID 2420 wrote to memory of 1952 2420 cmd.exe 34 PID 2420 wrote to memory of 1952 2420 cmd.exe 34 PID 340 wrote to memory of 2024 340 028a372b6824baeda7c68457ed544458_JaffaCakes118.exe 35 PID 340 wrote to memory of 2024 340 028a372b6824baeda7c68457ed544458_JaffaCakes118.exe 35 PID 340 wrote to memory of 2024 340 028a372b6824baeda7c68457ed544458_JaffaCakes118.exe 35 PID 340 wrote to memory of 2024 340 028a372b6824baeda7c68457ed544458_JaffaCakes118.exe 35 PID 2024 wrote to memory of 2936 2024 indiagamcaa.exe 36 PID 2024 wrote to memory of 2936 2024 indiagamcaa.exe 36 PID 2024 wrote to memory of 2936 2024 indiagamcaa.exe 36 PID 2024 wrote to memory of 2936 2024 indiagamcaa.exe 36 PID 2024 wrote to memory of 2936 2024 indiagamcaa.exe 36 PID 2024 wrote to memory of 2936 2024 indiagamcaa.exe 36 PID 2024 wrote to memory of 2936 2024 indiagamcaa.exe 36 PID 2024 wrote to memory of 2936 2024 indiagamcaa.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\028a372b6824baeda7c68457ed544458_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\028a372b6824baeda7c68457ed544458_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\028a372b6824baeda7c68457ed544458_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\028a372b6824baeda7c68457ed544458_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:340 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\VHFJE.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "indiagamcaaa" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\india gamcaa\indiagamcaa.exe" /f4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1952
-
-
-
C:\Users\Admin\AppData\Roaming\india gamcaa\indiagamcaa.exe"C:\Users\Admin\AppData\Roaming\india gamcaa\indiagamcaa.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Roaming\india gamcaa\indiagamcaa.exe"C:\Users\Admin\AppData\Roaming\india gamcaa\indiagamcaa.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2936
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
158B
MD5033ff48e13742ca54269e0846484b830
SHA1082ce1eed215dda59ea75a8227f8cd0e1b15d36f
SHA256597efbff7588882d8866604df4e7a4f715418a7d9bae4736029412fda3bfa455
SHA5128727692731b3788a5f8a5b5d4e79f009a8953d9a236f66e4cdc963c82c9aff3b6e833a491f78f88d55d8bad4d46f5d81e279974600ddbe5ea2c42003f043adda
-
Filesize
132KB
MD5da0b064c5f92b5ce403342a8d01ce37e
SHA11c680426a06fc5123c6c818b892ae30639c95507
SHA256369c0947acb54ba7e1f48e72538fce0c5a8b9c312351975bc1a23ebca3c24bbe
SHA512a002d3ad8c9cbe6f86751ee271e557266397f7af5b9d2f07637bc1e38bda12846f9b3fbe85a0c8f3af8fa20104196f9485c1f05fb0c5e8d8b21d13f5388e73f7