Analysis
-
max time kernel
145s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
03-10-2024 01:52
Static task
static1
Behavioral task
behavioral1
Sample
0d608561f2cd7fbe41b08f9a5a01228f_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
0d608561f2cd7fbe41b08f9a5a01228f_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
0d608561f2cd7fbe41b08f9a5a01228f_JaffaCakes118.exe
-
Size
2.7MB
-
MD5
0d608561f2cd7fbe41b08f9a5a01228f
-
SHA1
0b1ce4bde66214d64ebf50d9c7491ee933ffee64
-
SHA256
6447cac73ac33854ef0f940ef37b0ab07f9b6852d6e93b16cfc821e6a2c8756c
-
SHA512
d47fc5852fcb50c2c354d5871386ef226e3e6ce3fa3d5b0bca029fd229656daf24ca84953c2f15c98f67b9b211d3d51ef0712a738492c9e51d9d27d8a993870f
-
SSDEEP
49152:axO686ZUfB9XkR9RBXk5JioQrgzgvuwQFop0XF0UEoIyjT2/:axO686ifC9c5EszgvuwQFop9ToIyj6
Malware Config
Extracted
bitrat
1.38
jairoandresotalvarorend.linkpc.net:9083
-
communication_password
bfdba24ee3d61f0260c4dc1034c3ee43
-
install_dir
winlogomwindefenders
-
install_file
winlogomwindefender.exe
-
tor_process
tor
Signatures
-
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogomwindefender = "C:\\Users\\Admin\\AppData\\Local\\winlogomwindefenders\\winlogomwindefender.exe뼀" 0d608561f2cd7fbe41b08f9a5a01228f_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogomwindefender = "C:\\Users\\Admin\\AppData\\Local\\winlogomwindefenders\\winlogomwindefender.exe" 0d608561f2cd7fbe41b08f9a5a01228f_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogomwindefender = "C:\\Users\\Admin\\AppData\\Local\\winlogomwindefenders\\winlogomwindefender.exe턀" 0d608561f2cd7fbe41b08f9a5a01228f_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogomwindefender = "C:\\Users\\Admin\\AppData\\Local\\winlogomwindefenders\\winlogomwindefender.exe踀" 0d608561f2cd7fbe41b08f9a5a01228f_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogomwindefender = "C:\\Users\\Admin\\AppData\\Local\\winlogomwindefenders\\winlogomwindefender.exe䠀" 0d608561f2cd7fbe41b08f9a5a01228f_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogomwindefender = "C:\\Users\\Admin\\AppData\\Local\\winlogomwindefenders\\winlogomwindefender.exe\uf400" 0d608561f2cd7fbe41b08f9a5a01228f_JaffaCakes118.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
pid Process 2748 0d608561f2cd7fbe41b08f9a5a01228f_JaffaCakes118.exe 2748 0d608561f2cd7fbe41b08f9a5a01228f_JaffaCakes118.exe 2748 0d608561f2cd7fbe41b08f9a5a01228f_JaffaCakes118.exe 2748 0d608561f2cd7fbe41b08f9a5a01228f_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4944 set thread context of 2748 4944 0d608561f2cd7fbe41b08f9a5a01228f_JaffaCakes118.exe 92 -
resource yara_rule behavioral2/memory/2748-14-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/2748-15-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/2748-18-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/2748-16-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/2748-13-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/2748-22-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/2748-28-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/2748-30-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/2748-31-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/2748-32-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/2748-34-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/2748-35-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/2748-39-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/2748-40-0x0000000000400000-0x00000000007E4000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0d608561f2cd7fbe41b08f9a5a01228f_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0d608561f2cd7fbe41b08f9a5a01228f_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4944 0d608561f2cd7fbe41b08f9a5a01228f_JaffaCakes118.exe 4944 0d608561f2cd7fbe41b08f9a5a01228f_JaffaCakes118.exe -
Suspicious behavior: RenamesItself 21 IoCs
pid Process 2748 0d608561f2cd7fbe41b08f9a5a01228f_JaffaCakes118.exe 2748 0d608561f2cd7fbe41b08f9a5a01228f_JaffaCakes118.exe 2748 0d608561f2cd7fbe41b08f9a5a01228f_JaffaCakes118.exe 2748 0d608561f2cd7fbe41b08f9a5a01228f_JaffaCakes118.exe 2748 0d608561f2cd7fbe41b08f9a5a01228f_JaffaCakes118.exe 2748 0d608561f2cd7fbe41b08f9a5a01228f_JaffaCakes118.exe 2748 0d608561f2cd7fbe41b08f9a5a01228f_JaffaCakes118.exe 2748 0d608561f2cd7fbe41b08f9a5a01228f_JaffaCakes118.exe 2748 0d608561f2cd7fbe41b08f9a5a01228f_JaffaCakes118.exe 2748 0d608561f2cd7fbe41b08f9a5a01228f_JaffaCakes118.exe 2748 0d608561f2cd7fbe41b08f9a5a01228f_JaffaCakes118.exe 2748 0d608561f2cd7fbe41b08f9a5a01228f_JaffaCakes118.exe 2748 0d608561f2cd7fbe41b08f9a5a01228f_JaffaCakes118.exe 2748 0d608561f2cd7fbe41b08f9a5a01228f_JaffaCakes118.exe 2748 0d608561f2cd7fbe41b08f9a5a01228f_JaffaCakes118.exe 2748 0d608561f2cd7fbe41b08f9a5a01228f_JaffaCakes118.exe 2748 0d608561f2cd7fbe41b08f9a5a01228f_JaffaCakes118.exe 2748 0d608561f2cd7fbe41b08f9a5a01228f_JaffaCakes118.exe 2748 0d608561f2cd7fbe41b08f9a5a01228f_JaffaCakes118.exe 2748 0d608561f2cd7fbe41b08f9a5a01228f_JaffaCakes118.exe 2748 0d608561f2cd7fbe41b08f9a5a01228f_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4944 0d608561f2cd7fbe41b08f9a5a01228f_JaffaCakes118.exe Token: SeShutdownPrivilege 2748 0d608561f2cd7fbe41b08f9a5a01228f_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2748 0d608561f2cd7fbe41b08f9a5a01228f_JaffaCakes118.exe 2748 0d608561f2cd7fbe41b08f9a5a01228f_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 4944 wrote to memory of 3276 4944 0d608561f2cd7fbe41b08f9a5a01228f_JaffaCakes118.exe 91 PID 4944 wrote to memory of 3276 4944 0d608561f2cd7fbe41b08f9a5a01228f_JaffaCakes118.exe 91 PID 4944 wrote to memory of 3276 4944 0d608561f2cd7fbe41b08f9a5a01228f_JaffaCakes118.exe 91 PID 4944 wrote to memory of 2748 4944 0d608561f2cd7fbe41b08f9a5a01228f_JaffaCakes118.exe 92 PID 4944 wrote to memory of 2748 4944 0d608561f2cd7fbe41b08f9a5a01228f_JaffaCakes118.exe 92 PID 4944 wrote to memory of 2748 4944 0d608561f2cd7fbe41b08f9a5a01228f_JaffaCakes118.exe 92 PID 4944 wrote to memory of 2748 4944 0d608561f2cd7fbe41b08f9a5a01228f_JaffaCakes118.exe 92 PID 4944 wrote to memory of 2748 4944 0d608561f2cd7fbe41b08f9a5a01228f_JaffaCakes118.exe 92 PID 4944 wrote to memory of 2748 4944 0d608561f2cd7fbe41b08f9a5a01228f_JaffaCakes118.exe 92 PID 4944 wrote to memory of 2748 4944 0d608561f2cd7fbe41b08f9a5a01228f_JaffaCakes118.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\0d608561f2cd7fbe41b08f9a5a01228f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0d608561f2cd7fbe41b08f9a5a01228f_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\0d608561f2cd7fbe41b08f9a5a01228f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0d608561f2cd7fbe41b08f9a5a01228f_JaffaCakes118.exe"2⤵PID:3276
-
-
C:\Users\Admin\AppData\Local\Temp\0d608561f2cd7fbe41b08f9a5a01228f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0d608561f2cd7fbe41b08f9a5a01228f_JaffaCakes118.exe"2⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2748
-