Analysis
-
max time kernel
125s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02-10-2024 01:32
Static task
static1
Behavioral task
behavioral1
Sample
0843c2b2637d5c7f6a9e4867ef2a9ff4_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0843c2b2637d5c7f6a9e4867ef2a9ff4_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
0843c2b2637d5c7f6a9e4867ef2a9ff4_JaffaCakes118.exe
-
Size
631KB
-
MD5
0843c2b2637d5c7f6a9e4867ef2a9ff4
-
SHA1
8d16bb23e21ca07a3ac2069bc3458847d0758f90
-
SHA256
bbe0f74fca386e4bd78dd21c03f4b9f6086691318d684caca0fecb2122d28961
-
SHA512
8571bcdc26eacf62c463038e7258bde1053db90ac2aea2d5e053c74b6201d370df8bcf0aa82bedf4be77d04bf53ec5c7992c2f32ab2d2c985df5ef74d17f2348
-
SSDEEP
12288:dZbp5e49S8/KtMJqmweBqRYmrCnBYOcOd3tmBvBO/IT3Y4rTM0Hlg:dZbnhE6KtMJqHeBqaWMuOcOptmm1eg0
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation 0843c2b2637d5c7f6a9e4867ef2a9ff4_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation 0843c2b2637d5c7f6a9e4867ef2a9ff4_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation 0843c2b2637d5c7f6a9e4867ef2a9ff4_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SteamUpdates = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\SteamUpdates\\SteamUpdates.exe\"" 0843c2b2637d5c7f6a9e4867ef2a9ff4_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2444 set thread context of 1584 2444 0843c2b2637d5c7f6a9e4867ef2a9ff4_JaffaCakes118.exe 101 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0843c2b2637d5c7f6a9e4867ef2a9ff4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0843c2b2637d5c7f6a9e4867ef2a9ff4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0843c2b2637d5c7f6a9e4867ef2a9ff4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 3544 powershell.exe 3544 powershell.exe 3544 powershell.exe 2444 0843c2b2637d5c7f6a9e4867ef2a9ff4_JaffaCakes118.exe 2444 0843c2b2637d5c7f6a9e4867ef2a9ff4_JaffaCakes118.exe 4536 powershell.exe 4536 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3544 powershell.exe Token: SeIncreaseQuotaPrivilege 3544 powershell.exe Token: SeSecurityPrivilege 3544 powershell.exe Token: SeTakeOwnershipPrivilege 3544 powershell.exe Token: SeLoadDriverPrivilege 3544 powershell.exe Token: SeSystemProfilePrivilege 3544 powershell.exe Token: SeSystemtimePrivilege 3544 powershell.exe Token: SeProfSingleProcessPrivilege 3544 powershell.exe Token: SeIncBasePriorityPrivilege 3544 powershell.exe Token: SeCreatePagefilePrivilege 3544 powershell.exe Token: SeBackupPrivilege 3544 powershell.exe Token: SeRestorePrivilege 3544 powershell.exe Token: SeShutdownPrivilege 3544 powershell.exe Token: SeDebugPrivilege 3544 powershell.exe Token: SeSystemEnvironmentPrivilege 3544 powershell.exe Token: SeRemoteShutdownPrivilege 3544 powershell.exe Token: SeUndockPrivilege 3544 powershell.exe Token: SeManageVolumePrivilege 3544 powershell.exe Token: 33 3544 powershell.exe Token: 34 3544 powershell.exe Token: 35 3544 powershell.exe Token: 36 3544 powershell.exe Token: SeIncreaseQuotaPrivilege 3544 powershell.exe Token: SeSecurityPrivilege 3544 powershell.exe Token: SeTakeOwnershipPrivilege 3544 powershell.exe Token: SeLoadDriverPrivilege 3544 powershell.exe Token: SeSystemProfilePrivilege 3544 powershell.exe Token: SeSystemtimePrivilege 3544 powershell.exe Token: SeProfSingleProcessPrivilege 3544 powershell.exe Token: SeIncBasePriorityPrivilege 3544 powershell.exe Token: SeCreatePagefilePrivilege 3544 powershell.exe Token: SeBackupPrivilege 3544 powershell.exe Token: SeRestorePrivilege 3544 powershell.exe Token: SeShutdownPrivilege 3544 powershell.exe Token: SeDebugPrivilege 3544 powershell.exe Token: SeSystemEnvironmentPrivilege 3544 powershell.exe Token: SeRemoteShutdownPrivilege 3544 powershell.exe Token: SeUndockPrivilege 3544 powershell.exe Token: SeManageVolumePrivilege 3544 powershell.exe Token: 33 3544 powershell.exe Token: 34 3544 powershell.exe Token: 35 3544 powershell.exe Token: 36 3544 powershell.exe Token: SeDebugPrivilege 2444 0843c2b2637d5c7f6a9e4867ef2a9ff4_JaffaCakes118.exe Token: SeDebugPrivilege 1584 0843c2b2637d5c7f6a9e4867ef2a9ff4_JaffaCakes118.exe Token: SeDebugPrivilege 4536 powershell.exe Token: SeIncreaseQuotaPrivilege 4536 powershell.exe Token: SeSecurityPrivilege 4536 powershell.exe Token: SeTakeOwnershipPrivilege 4536 powershell.exe Token: SeLoadDriverPrivilege 4536 powershell.exe Token: SeSystemProfilePrivilege 4536 powershell.exe Token: SeSystemtimePrivilege 4536 powershell.exe Token: SeProfSingleProcessPrivilege 4536 powershell.exe Token: SeIncBasePriorityPrivilege 4536 powershell.exe Token: SeCreatePagefilePrivilege 4536 powershell.exe Token: SeBackupPrivilege 4536 powershell.exe Token: SeRestorePrivilege 4536 powershell.exe Token: SeShutdownPrivilege 4536 powershell.exe Token: SeDebugPrivilege 4536 powershell.exe Token: SeSystemEnvironmentPrivilege 4536 powershell.exe Token: SeRemoteShutdownPrivilege 4536 powershell.exe Token: SeUndockPrivilege 4536 powershell.exe Token: SeManageVolumePrivilege 4536 powershell.exe Token: 33 4536 powershell.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 2444 wrote to memory of 3544 2444 0843c2b2637d5c7f6a9e4867ef2a9ff4_JaffaCakes118.exe 94 PID 2444 wrote to memory of 3544 2444 0843c2b2637d5c7f6a9e4867ef2a9ff4_JaffaCakes118.exe 94 PID 2444 wrote to memory of 3544 2444 0843c2b2637d5c7f6a9e4867ef2a9ff4_JaffaCakes118.exe 94 PID 2444 wrote to memory of 1584 2444 0843c2b2637d5c7f6a9e4867ef2a9ff4_JaffaCakes118.exe 101 PID 2444 wrote to memory of 1584 2444 0843c2b2637d5c7f6a9e4867ef2a9ff4_JaffaCakes118.exe 101 PID 2444 wrote to memory of 1584 2444 0843c2b2637d5c7f6a9e4867ef2a9ff4_JaffaCakes118.exe 101 PID 2444 wrote to memory of 1584 2444 0843c2b2637d5c7f6a9e4867ef2a9ff4_JaffaCakes118.exe 101 PID 2444 wrote to memory of 1584 2444 0843c2b2637d5c7f6a9e4867ef2a9ff4_JaffaCakes118.exe 101 PID 2444 wrote to memory of 1584 2444 0843c2b2637d5c7f6a9e4867ef2a9ff4_JaffaCakes118.exe 101 PID 2444 wrote to memory of 1584 2444 0843c2b2637d5c7f6a9e4867ef2a9ff4_JaffaCakes118.exe 101 PID 2444 wrote to memory of 1584 2444 0843c2b2637d5c7f6a9e4867ef2a9ff4_JaffaCakes118.exe 101 PID 1584 wrote to memory of 2820 1584 0843c2b2637d5c7f6a9e4867ef2a9ff4_JaffaCakes118.exe 103 PID 1584 wrote to memory of 2820 1584 0843c2b2637d5c7f6a9e4867ef2a9ff4_JaffaCakes118.exe 103 PID 1584 wrote to memory of 2820 1584 0843c2b2637d5c7f6a9e4867ef2a9ff4_JaffaCakes118.exe 103 PID 2820 wrote to memory of 4536 2820 0843c2b2637d5c7f6a9e4867ef2a9ff4_JaffaCakes118.exe 104 PID 2820 wrote to memory of 4536 2820 0843c2b2637d5c7f6a9e4867ef2a9ff4_JaffaCakes118.exe 104 PID 2820 wrote to memory of 4536 2820 0843c2b2637d5c7f6a9e4867ef2a9ff4_JaffaCakes118.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\0843c2b2637d5c7f6a9e4867ef2a9ff4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0843c2b2637d5c7f6a9e4867ef2a9ff4_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection Bing.com2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3544
-
-
C:\Users\Admin\AppData\Local\Temp\0843c2b2637d5c7f6a9e4867ef2a9ff4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0843c2b2637d5c7f6a9e4867ef2a9ff4_JaffaCakes118.exe2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\0843c2b2637d5c7f6a9e4867ef2a9ff4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0843c2b2637d5c7f6a9e4867ef2a9ff4_JaffaCakes118.exe"3⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection Bing.com4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4536
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4404,i,1330210614411927383,9239043499051775691,262144 --variations-seed-version --mojo-platform-channel-handle=1320 /prefetch:81⤵PID:4356
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\0843c2b2637d5c7f6a9e4867ef2a9ff4_JaffaCakes118.exe.log
Filesize1KB
MD57ebe314bf617dc3e48b995a6c352740c
SHA1538f643b7b30f9231a3035c448607f767527a870
SHA25648178f884b8a4dd96e330b210b0530667d9473a7629fc6b4ad12b614bf438ee8
SHA5120ba9d8f4244c15285e254d27b4bff7c49344ff845c48bc0bf0d8563072fab4d6f7a6abe6b6742e8375a08e9a3b3e5d5dc4937ab428dbe2dd8e62892fda04507e
-
Filesize
2KB
MD50774a05ce5ee4c1af7097353c9296c62
SHA1658ff96b111c21c39d7ad5f510fb72f9762114bb
SHA256d9c5347ed06755feeb0615f1671f6b91e2718703da0dbc4b0bd205cbd2896dd4
SHA512104d69fc4f4aaa5070b78ada130228939c7e01436351166fe51fe2da8a02f9948e6d92dd676f62820da1813872b91411e2f863c9a98a760581ec34d4aa354994
-
Filesize
19KB
MD53408f8f40f19f09d6b96185fdf38ac3a
SHA1e99d8d95b60cc8767fecd7f4467aa55f4e078929
SHA2568bea5c5daf75a27c5226db62998c0ef3f9c64e5b98fe59e4c14e4fe16d911011
SHA512f0765bb4afc07e16a8fc6527c37cff367eccf181792c18220fd9ed84276b9ed73a220e8e40d2aa66d4a067c200d2c190a93936faa5da0ea65ea2372a3d611e16
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82