Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
08/10/2024, 09:10
Behavioral task
behavioral1
Sample
20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
150 seconds
General
-
Target
20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe
-
Size
830KB
-
MD5
20bbd1360c722c9875c13614dfcd4a75
-
SHA1
6a37a82c17b79a99fee8de9b915b923177ca2eae
-
SHA256
bd22ac08d62202ab36e12bda39135d68711331a2d9bcc9e0b5579a30bb10db9f
-
SHA512
672e4e212e3dbc12cdcc5f97a1d2b41e3ad340c55a9114be37d21e937da8bc8add2a26b90513683408183aa4394c131f9e1b24ec3e4bcf07dd280a158d208e81
-
SSDEEP
24576:qwVMY2cvAZjtQmwCDZekassQYV5h7Mlp:qeMY2cYgXCDassQW5h7Mf
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate SERVER.EXE -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe -
Executes dropped EXE 2 IoCs
pid Process 4576 PERX.EXE 4496 SERVER.EXE -
resource yara_rule behavioral2/memory/2132-0-0x0000000000400000-0x0000000000579000-memory.dmp upx behavioral2/files/0x000c000000023b1c-6.dat upx behavioral2/memory/4576-16-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/files/0x000c000000023b77-18.dat upx behavioral2/memory/4496-21-0x0000000000400000-0x00000000004E5000-memory.dmp upx behavioral2/memory/2132-25-0x0000000000400000-0x0000000000579000-memory.dmp upx behavioral2/memory/4576-27-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4496-28-0x0000000000400000-0x00000000004E5000-memory.dmp upx behavioral2/memory/2132-30-0x0000000000400000-0x0000000000579000-memory.dmp upx behavioral2/memory/4496-32-0x0000000000400000-0x00000000004E5000-memory.dmp upx behavioral2/memory/2132-33-0x0000000000400000-0x0000000000579000-memory.dmp upx behavioral2/memory/4496-35-0x0000000000400000-0x00000000004E5000-memory.dmp upx behavioral2/memory/2132-36-0x0000000000400000-0x0000000000579000-memory.dmp upx behavioral2/memory/4496-38-0x0000000000400000-0x00000000004E5000-memory.dmp upx behavioral2/memory/4576-37-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/2132-39-0x0000000000400000-0x0000000000579000-memory.dmp upx behavioral2/memory/4496-41-0x0000000000400000-0x00000000004E5000-memory.dmp upx behavioral2/memory/2132-42-0x0000000000400000-0x0000000000579000-memory.dmp upx behavioral2/memory/4496-44-0x0000000000400000-0x00000000004E5000-memory.dmp upx behavioral2/memory/2132-45-0x0000000000400000-0x0000000000579000-memory.dmp upx behavioral2/memory/4496-47-0x0000000000400000-0x00000000004E5000-memory.dmp upx behavioral2/memory/2132-48-0x0000000000400000-0x0000000000579000-memory.dmp upx behavioral2/memory/4496-50-0x0000000000400000-0x00000000004E5000-memory.dmp upx behavioral2/memory/2132-51-0x0000000000400000-0x0000000000579000-memory.dmp upx behavioral2/memory/4496-53-0x0000000000400000-0x00000000004E5000-memory.dmp upx behavioral2/memory/2132-54-0x0000000000400000-0x0000000000579000-memory.dmp upx behavioral2/memory/4496-56-0x0000000000400000-0x00000000004E5000-memory.dmp upx behavioral2/memory/2132-57-0x0000000000400000-0x0000000000579000-memory.dmp upx behavioral2/memory/4496-59-0x0000000000400000-0x00000000004E5000-memory.dmp upx behavioral2/memory/2132-60-0x0000000000400000-0x0000000000579000-memory.dmp upx behavioral2/memory/4496-62-0x0000000000400000-0x00000000004E5000-memory.dmp upx behavioral2/memory/2132-63-0x0000000000400000-0x0000000000579000-memory.dmp upx behavioral2/memory/4576-64-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4496-65-0x0000000000400000-0x00000000004E5000-memory.dmp upx behavioral2/memory/2132-66-0x0000000000400000-0x0000000000579000-memory.dmp upx behavioral2/memory/4496-68-0x0000000000400000-0x00000000004E5000-memory.dmp upx behavioral2/memory/2132-69-0x0000000000400000-0x0000000000579000-memory.dmp upx behavioral2/memory/4496-71-0x0000000000400000-0x00000000004E5000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PERX.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SERVER.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe -
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString SERVER.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier SERVER.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier SERVER.EXE Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 SERVER.EXE -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier SERVER.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4576 PERX.EXE 4576 PERX.EXE 4576 PERX.EXE 4576 PERX.EXE 4576 PERX.EXE 4576 PERX.EXE 4576 PERX.EXE 4576 PERX.EXE 4576 PERX.EXE 4576 PERX.EXE 4576 PERX.EXE 4576 PERX.EXE 4576 PERX.EXE 4576 PERX.EXE 4576 PERX.EXE 4576 PERX.EXE 4576 PERX.EXE 4576 PERX.EXE 4576 PERX.EXE 4576 PERX.EXE 4576 PERX.EXE 4576 PERX.EXE 4576 PERX.EXE 4576 PERX.EXE 4576 PERX.EXE 4576 PERX.EXE 4576 PERX.EXE 4576 PERX.EXE 4576 PERX.EXE 4576 PERX.EXE 4576 PERX.EXE 4576 PERX.EXE 4576 PERX.EXE 4576 PERX.EXE 4576 PERX.EXE 4576 PERX.EXE 4576 PERX.EXE 4576 PERX.EXE 4576 PERX.EXE 4576 PERX.EXE 4576 PERX.EXE 4576 PERX.EXE 4576 PERX.EXE 4576 PERX.EXE 4576 PERX.EXE 4576 PERX.EXE 4576 PERX.EXE 4576 PERX.EXE 4576 PERX.EXE 4576 PERX.EXE 4576 PERX.EXE 4576 PERX.EXE 4576 PERX.EXE 4576 PERX.EXE 4576 PERX.EXE 4576 PERX.EXE 4576 PERX.EXE 4576 PERX.EXE 4576 PERX.EXE 4576 PERX.EXE 4576 PERX.EXE 4576 PERX.EXE 4576 PERX.EXE 4576 PERX.EXE -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2132 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe Token: SeSecurityPrivilege 2132 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2132 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe Token: SeLoadDriverPrivilege 2132 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe Token: SeSystemProfilePrivilege 2132 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe Token: SeSystemtimePrivilege 2132 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 2132 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2132 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 2132 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe Token: SeBackupPrivilege 2132 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe Token: SeRestorePrivilege 2132 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe Token: SeShutdownPrivilege 2132 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe Token: SeDebugPrivilege 2132 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 2132 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 2132 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 2132 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe Token: SeUndockPrivilege 2132 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe Token: SeManageVolumePrivilege 2132 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe Token: SeImpersonatePrivilege 2132 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 2132 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe Token: 33 2132 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe Token: 34 2132 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe Token: 35 2132 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe Token: 36 2132 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 4496 SERVER.EXE Token: SeSecurityPrivilege 4496 SERVER.EXE Token: SeTakeOwnershipPrivilege 4496 SERVER.EXE Token: SeLoadDriverPrivilege 4496 SERVER.EXE Token: SeSystemProfilePrivilege 4496 SERVER.EXE Token: SeSystemtimePrivilege 4496 SERVER.EXE Token: SeProfSingleProcessPrivilege 4496 SERVER.EXE Token: SeIncBasePriorityPrivilege 4496 SERVER.EXE Token: SeCreatePagefilePrivilege 4496 SERVER.EXE Token: SeBackupPrivilege 4496 SERVER.EXE Token: SeRestorePrivilege 4496 SERVER.EXE Token: SeShutdownPrivilege 4496 SERVER.EXE Token: SeDebugPrivilege 4496 SERVER.EXE Token: SeSystemEnvironmentPrivilege 4496 SERVER.EXE Token: SeChangeNotifyPrivilege 4496 SERVER.EXE Token: SeRemoteShutdownPrivilege 4496 SERVER.EXE Token: SeUndockPrivilege 4496 SERVER.EXE Token: SeManageVolumePrivilege 4496 SERVER.EXE Token: SeImpersonatePrivilege 4496 SERVER.EXE Token: SeCreateGlobalPrivilege 4496 SERVER.EXE Token: 33 4496 SERVER.EXE Token: 34 4496 SERVER.EXE Token: 35 4496 SERVER.EXE Token: 36 4496 SERVER.EXE -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2132 wrote to memory of 4576 2132 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe 84 PID 2132 wrote to memory of 4576 2132 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe 84 PID 2132 wrote to memory of 4576 2132 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe 84 PID 2132 wrote to memory of 4496 2132 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe 85 PID 2132 wrote to memory of 4496 2132 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe 85 PID 2132 wrote to memory of 4496 2132 20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\20bbd1360c722c9875c13614dfcd4a75_JaffaCakes118.exe"1⤵
- Checks BIOS information in registry
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\PERX.EXE"C:\Users\Admin\AppData\Local\Temp\PERX.EXE"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4576
-
-
C:\Users\Admin\AppData\Local\Temp\SERVER.EXE"C:\Users\Admin\AppData\Local\Temp\SERVER.EXE"2⤵
- Checks BIOS information in registry
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:4496
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
262KB
MD5e974a7ed7fa0c096aa1f59ae6d8cce72
SHA124b215e712fa745ac94d033ee7c5a556a5df0dab
SHA256d042a6add7b1547e5165d0c0c0f0eb21ee778b44c27e0a2bbce9f02b79156c0b
SHA512156cfa7b252d8737a4d3fdc3f8095353051d7f15e1293d6c1213de36ea44d526fd94e75765b3a1f75ed83f9b02dd4329b9eab466e9188fea107e622d0c1d6ba4
-
Filesize
330KB
MD5313a7ff866055ca1434ebc65f3fc1130
SHA1c2558051b179df53b198f736e20407dd9b1d429f
SHA256341f9fcb0845fbccd57e12d555696644e4a32b0ccdf00d6a825bc8fb2419c94d
SHA512a68ed855ab64cae35f9eb62846cc164d2b9ef35764515ffa8a001d397dcaa9b56d395d48a812b1453ee1eba4d3c537c5909860d1746f64ee2587e8a600862449