Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
16-10-2024 18:36
Static task
static1
Behavioral task
behavioral1
Sample
4e62ce349bf0b83eb5290e166f8b1640_JaffaCakes118.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
4e62ce349bf0b83eb5290e166f8b1640_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
4e62ce349bf0b83eb5290e166f8b1640_JaffaCakes118.exe
-
Size
220KB
-
MD5
4e62ce349bf0b83eb5290e166f8b1640
-
SHA1
2cfed0ac41cef40837ae9efff2ac53a0fcb4a7c6
-
SHA256
cc3a14fc4597290919d7f8b806634f722a50eead9319bd115a84cb0cd3691227
-
SHA512
4204502044adb6c429d85eea7ad656f6677361e716f606a44b469006e9fc33fd527d12a58255a46abf192f80e77256ab434f211ffefd7eba098a8236d2b93ebc
-
SSDEEP
3072:4Vnaqq7y2RpRlrtowJL1rnEbgQInHNY5aMdflZs68jv:ynaqq7J3iuhWgrntShyv
Malware Config
Signatures
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1cd5ffe.exe explorer.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1cd5ff = "C:\\1cd5ffe\\1cd5ffe.exe" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\*cd5ff = "C:\\1cd5ffe\\1cd5ffe.exe" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1cd5ffe = "C:\\Users\\Admin\\AppData\\Roaming\\1cd5ffe.exe" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\*cd5ffe = "C:\\Users\\Admin\\AppData\\Roaming\\1cd5ffe.exe" explorer.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4e62ce349bf0b83eb5290e166f8b1640_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 1072 4e62ce349bf0b83eb5290e166f8b1640_JaffaCakes118.exe 4896 explorer.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1072 wrote to memory of 4896 1072 4e62ce349bf0b83eb5290e166f8b1640_JaffaCakes118.exe 84 PID 1072 wrote to memory of 4896 1072 4e62ce349bf0b83eb5290e166f8b1640_JaffaCakes118.exe 84 PID 1072 wrote to memory of 4896 1072 4e62ce349bf0b83eb5290e166f8b1640_JaffaCakes118.exe 84 PID 4896 wrote to memory of 4120 4896 explorer.exe 88 PID 4896 wrote to memory of 4120 4896 explorer.exe 88 PID 4896 wrote to memory of 4120 4896 explorer.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\4e62ce349bf0b83eb5290e166f8b1640_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4e62ce349bf0b83eb5290e166f8b1640_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\syswow64\explorer.exe"2⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Windows\SysWOW64\svchost.exe-k netsvcs3⤵
- System Location Discovery: System Language Discovery
PID:4120
-
-