Analysis
-
max time kernel
93s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
12-10-2024 10:38
Behavioral task
behavioral1
Sample
3990f4b65ff91e1b5b56517fb2a6a7fc_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
3990f4b65ff91e1b5b56517fb2a6a7fc_JaffaCakes118.exe
-
Size
195KB
-
MD5
3990f4b65ff91e1b5b56517fb2a6a7fc
-
SHA1
ced7cf4d1a7293a6d2d475a1ebaff79f9d663840
-
SHA256
92d5d96b775b95f06d4d5d27e063cc187f7af38fbf24f9314e5ed199da3ef8f1
-
SHA512
ff154d3f5e2053a0ee891f97905b9c46f671b600497317dc3daccbe31e21330af9af96389ff0357b98cb7b9395da281251489c552ddcc1087e1c6a5f411e4f80
-
SSDEEP
3072:gAwixCZ6Sh77R2Gpf606U8v0e7OIgPDFIbbzhPM67fIhUK:gExhk7rh7NEOIYWlPM6r6UK
Malware Config
Extracted
urelas
218.54.47.76
218.54.47.77
218.54.47.74
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
3990f4b65ff91e1b5b56517fb2a6a7fc_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation 3990f4b65ff91e1b5b56517fb2a6a7fc_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
Processes:
biudfw.exepid process 856 biudfw.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
3990f4b65ff91e1b5b56517fb2a6a7fc_JaffaCakes118.exebiudfw.execmd.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3990f4b65ff91e1b5b56517fb2a6a7fc_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language biudfw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
3990f4b65ff91e1b5b56517fb2a6a7fc_JaffaCakes118.exedescription pid process target process PID 1900 wrote to memory of 856 1900 3990f4b65ff91e1b5b56517fb2a6a7fc_JaffaCakes118.exe biudfw.exe PID 1900 wrote to memory of 856 1900 3990f4b65ff91e1b5b56517fb2a6a7fc_JaffaCakes118.exe biudfw.exe PID 1900 wrote to memory of 856 1900 3990f4b65ff91e1b5b56517fb2a6a7fc_JaffaCakes118.exe biudfw.exe PID 1900 wrote to memory of 4968 1900 3990f4b65ff91e1b5b56517fb2a6a7fc_JaffaCakes118.exe cmd.exe PID 1900 wrote to memory of 4968 1900 3990f4b65ff91e1b5b56517fb2a6a7fc_JaffaCakes118.exe cmd.exe PID 1900 wrote to memory of 4968 1900 3990f4b65ff91e1b5b56517fb2a6a7fc_JaffaCakes118.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3990f4b65ff91e1b5b56517fb2a6a7fc_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3990f4b65ff91e1b5b56517fb2a6a7fc_JaffaCakes118.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\biudfw.exe"C:\Users\Admin\AppData\Local\Temp\biudfw.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:856
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "2⤵
- System Location Discovery: System Language Discovery
PID:4968
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
195KB
MD5123a4d1c58209bc195d1691e62ea7893
SHA10f21880192f65a40e5a2c3fd871f7eef979dcc85
SHA2560454bd0815f0ba9313e353a1bfd06f31dc8106c93edffdd6b66ab2fefbf43aea
SHA51276398e6893ef866027591d4d955ae76009191db08542342def6777d8229a1b8372c23fbed80d22ae62f33dfed2b3c00088330c31f89d0bc363b558ca458842ed
-
Filesize
512B
MD52776cde4761cefd1198f4712989957b1
SHA1c801245a080524e704e8e3da95700e58e9d1ca3c
SHA25669ca5964abf7f1c054541bcc32f2712d3fa51342913affed5023825e3dca521f
SHA512bdc242f5c69d10cbfa903bbf20448a9e93213ee303091f1ae9ff8d29c83250168491d9b553841f8ed9b756aef29c499eea3562ff9f94b5619012eb21d5d88c4a
-
Filesize
302B
MD59f977c7bb354748c9f15380bc18f9b70
SHA1b6db88571b919696f56d314af7f44a57c391e92f
SHA25693194f3a481301602ebbd785c024a6b6b1b315164dcd6a4a02956223e2c75bfd
SHA5123ad6f01bfad9c29b8a8c789ff2defc5f4cdb6833af900937eebf5d30b94c6f6e2004c8e6106d5d3d7bfb6ef5fd9123ccd67743f13ce0cb2631f9743d6cb94c72