Analysis
-
max time kernel
139s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
14-10-2024 20:07
Static task
static1
Behavioral task
behavioral1
Sample
43f70f6bb37593e40b4943e9e95edf48_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
43f70f6bb37593e40b4943e9e95edf48_JaffaCakes118.exe
-
Size
59KB
-
MD5
43f70f6bb37593e40b4943e9e95edf48
-
SHA1
37ad1fce32bca02c1eada6db421f945461dc409b
-
SHA256
7fce64c5c5831ed61df104c4e787fdfc9772fd4dbe8ef1a0f60c679f5bcf16aa
-
SHA512
134ffa376c1ec0f3a43e0e37a140592553ebdf5b4bf591ac331ce5d6a211604a7a533f349d7d6278420bd3646d20edb4c68ebb5a31e60d804ae517878d39e5ce
-
SSDEEP
768:n5mhew0GpSyMe6hwUkdwJzh+qciaQRENEzxZbARtR06g2wqp4YPeznellmqGwxP5:nK0GjMeQG3iaQREuVZ6ro29p4YxbKdA
Malware Config
Extracted
urelas
218.54.47.76
218.54.47.77
218.54.47.74
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
43f70f6bb37593e40b4943e9e95edf48_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation 43f70f6bb37593e40b4943e9e95edf48_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
Processes:
biudfw.exepid process 2980 biudfw.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
43f70f6bb37593e40b4943e9e95edf48_JaffaCakes118.exebiudfw.execmd.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 43f70f6bb37593e40b4943e9e95edf48_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language biudfw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
43f70f6bb37593e40b4943e9e95edf48_JaffaCakes118.exedescription pid process target process PID 2080 wrote to memory of 2980 2080 43f70f6bb37593e40b4943e9e95edf48_JaffaCakes118.exe biudfw.exe PID 2080 wrote to memory of 2980 2080 43f70f6bb37593e40b4943e9e95edf48_JaffaCakes118.exe biudfw.exe PID 2080 wrote to memory of 2980 2080 43f70f6bb37593e40b4943e9e95edf48_JaffaCakes118.exe biudfw.exe PID 2080 wrote to memory of 3396 2080 43f70f6bb37593e40b4943e9e95edf48_JaffaCakes118.exe cmd.exe PID 2080 wrote to memory of 3396 2080 43f70f6bb37593e40b4943e9e95edf48_JaffaCakes118.exe cmd.exe PID 2080 wrote to memory of 3396 2080 43f70f6bb37593e40b4943e9e95edf48_JaffaCakes118.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\43f70f6bb37593e40b4943e9e95edf48_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\43f70f6bb37593e40b4943e9e95edf48_JaffaCakes118.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\biudfw.exe"C:\Users\Admin\AppData\Local\Temp\biudfw.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2980
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "2⤵
- System Location Discovery: System Language Discovery
PID:3396
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
59KB
MD5885b73f7f66530b5d0fee7dc932cd0e0
SHA117d0e5d7c5e539223f49f8dd8548405a1defee7b
SHA256c4215a3dd1645b1a417ad973d3e9fa0f5c43f8fdb8fdfa417406dfba6a3eb161
SHA5124db24820370980212cefeb4102fad63b38866dde94401fc403e96077d17213c6565b1702fd2b6e707c6235c4d4c70983e3b8ec10868afabcbbfb6c2aecf0e67b
-
Filesize
512B
MD555e10a9af74d3f3fa5ae3cb7ff5ad9d4
SHA1449221fd8d7196a54de2bd583625d8d1b64db56a
SHA256a945a44cfe50423c01f26a16445ed177a347052e791364a9cb7de6bcaa18f3c1
SHA5124af5ba74467b4c61302ea9571f19346c05f911843f2c6153fcd9a7340f9bc6e1f8867cdb72ec7ba0dc4930199aa5c302711ad5da9fd35241839418f6e70a515a
-
Filesize
302B
MD518da1fa6e662efbb03311968b810f706
SHA1d36dbdd5ca383a2eb025959877dcc07a95079b06
SHA25695f3230e7dfe567a4ba104380354e09d7e3ff493b14f44314389251082cb772d
SHA5123de0c7d2be6eabdce239e306b5ee011fcddd6ca6f6db820a4e9ea7fa07cd81a777d4aa9082f55548e4938ea70ab43add8afbd3f6b1424977eacf294f6d74cef0