Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
03-10-2024 09:17
Static task
static1
Behavioral task
behavioral1
Sample
0eebbc2aeb4f69fb37e18b32c82fedf0_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0eebbc2aeb4f69fb37e18b32c82fedf0_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
0eebbc2aeb4f69fb37e18b32c82fedf0_JaffaCakes118.exe
-
Size
661KB
-
MD5
0eebbc2aeb4f69fb37e18b32c82fedf0
-
SHA1
0316374272a15f8dc830b062788ee4fb65eaa526
-
SHA256
a828998e325b19ff3391f4be8c871ad5ec66dcccd716ee06430c57ba00bc48cf
-
SHA512
f0eb7c2e95a4d63c26b6b91e2a3ce2bb881858a808fc36c15636fd8ad2194af6ed3c07600d680950f488c8e93e6486631f972d16847a01bd3d01199905e1ea58
-
SSDEEP
12288:t4SACCy0pOX3rR1xEOJqUYbECyK8ZKOgCJNKosAd3YjyEyZFeI3eUF:tvjpHrhdcdEjKOtJNKoJ3OyZFXv
Malware Config
Signatures
-
Disables Task Manager via registry modification
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation 0eebbc2aeb4f69fb37e18b32c82fedf0_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 4504 winlogin.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Windows\\system32\\winlogin.exe\"" 0eebbc2aeb4f69fb37e18b32c82fedf0_JaffaCakes118.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\winlogin.exe 0eebbc2aeb4f69fb37e18b32c82fedf0_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\winlogin.exe 0eebbc2aeb4f69fb37e18b32c82fedf0_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winlogin.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0eebbc2aeb4f69fb37e18b32c82fedf0_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 32 IoCs
pid Process 1728 0eebbc2aeb4f69fb37e18b32c82fedf0_JaffaCakes118.exe 1728 0eebbc2aeb4f69fb37e18b32c82fedf0_JaffaCakes118.exe 1728 0eebbc2aeb4f69fb37e18b32c82fedf0_JaffaCakes118.exe 1728 0eebbc2aeb4f69fb37e18b32c82fedf0_JaffaCakes118.exe 1728 0eebbc2aeb4f69fb37e18b32c82fedf0_JaffaCakes118.exe 1728 0eebbc2aeb4f69fb37e18b32c82fedf0_JaffaCakes118.exe 1728 0eebbc2aeb4f69fb37e18b32c82fedf0_JaffaCakes118.exe 1728 0eebbc2aeb4f69fb37e18b32c82fedf0_JaffaCakes118.exe 1728 0eebbc2aeb4f69fb37e18b32c82fedf0_JaffaCakes118.exe 1728 0eebbc2aeb4f69fb37e18b32c82fedf0_JaffaCakes118.exe 1728 0eebbc2aeb4f69fb37e18b32c82fedf0_JaffaCakes118.exe 1728 0eebbc2aeb4f69fb37e18b32c82fedf0_JaffaCakes118.exe 1728 0eebbc2aeb4f69fb37e18b32c82fedf0_JaffaCakes118.exe 1728 0eebbc2aeb4f69fb37e18b32c82fedf0_JaffaCakes118.exe 1728 0eebbc2aeb4f69fb37e18b32c82fedf0_JaffaCakes118.exe 1728 0eebbc2aeb4f69fb37e18b32c82fedf0_JaffaCakes118.exe 4504 winlogin.exe 4504 winlogin.exe 4504 winlogin.exe 4504 winlogin.exe 4504 winlogin.exe 4504 winlogin.exe 4504 winlogin.exe 4504 winlogin.exe 4504 winlogin.exe 4504 winlogin.exe 4504 winlogin.exe 4504 winlogin.exe 4504 winlogin.exe 4504 winlogin.exe 4504 winlogin.exe 4504 winlogin.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1728 wrote to memory of 724 1728 0eebbc2aeb4f69fb37e18b32c82fedf0_JaffaCakes118.exe 82 PID 1728 wrote to memory of 724 1728 0eebbc2aeb4f69fb37e18b32c82fedf0_JaffaCakes118.exe 82 PID 1728 wrote to memory of 724 1728 0eebbc2aeb4f69fb37e18b32c82fedf0_JaffaCakes118.exe 82 PID 724 wrote to memory of 4504 724 cmd.exe 84 PID 724 wrote to memory of 4504 724 cmd.exe 84 PID 724 wrote to memory of 4504 724 cmd.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\0eebbc2aeb4f69fb37e18b32c82fedf0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0eebbc2aeb4f69fb37e18b32c82fedf0_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /cC:\Windows\system32\winlogin.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:724 -
C:\Windows\SysWOW64\winlogin.exeC:\Windows\system32\winlogin.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4504
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
661KB
MD50eebbc2aeb4f69fb37e18b32c82fedf0
SHA10316374272a15f8dc830b062788ee4fb65eaa526
SHA256a828998e325b19ff3391f4be8c871ad5ec66dcccd716ee06430c57ba00bc48cf
SHA512f0eb7c2e95a4d63c26b6b91e2a3ce2bb881858a808fc36c15636fd8ad2194af6ed3c07600d680950f488c8e93e6486631f972d16847a01bd3d01199905e1ea58