Analysis
-
max time kernel
142s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24-10-2024 02:29
Static task
static1
Behavioral task
behavioral1
Sample
71efd5f8d2ad4c891d4d52f2cce17561_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
71efd5f8d2ad4c891d4d52f2cce17561_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
71efd5f8d2ad4c891d4d52f2cce17561_JaffaCakes118.exe
-
Size
144KB
-
MD5
71efd5f8d2ad4c891d4d52f2cce17561
-
SHA1
f34013094d0de6756de5c4979181e1a468836454
-
SHA256
62c10c55dac6618eff4716e89de4bae41c429102fae8cae2f0ffc86a05ad82e2
-
SHA512
0f8bab954b18c6e57a3bd0b1b685a5c4d4b194ab30c4b0e8a192cf57d9343c33e7b3f2ed9cb8a815f931b702c528d01ac58f30b8bfa3921854b285cd899bd7b0
-
SSDEEP
3072:XNfr+k4XY4h+PhzjzrOdt9lES2jbxWGqe:XNf14D+PhznrOdmSbGqe
Malware Config
Extracted
tofsee
91.218.39.211
188.130.237.44
91.204.162.103
188.165.132.183
rgtryhbgddtyh.biz
wertdghbyrukl.ch
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation 71efd5f8d2ad4c891d4d52f2cce17561_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 3920 ylqdivow.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSConfig = "\"C:\\Users\\Admin\\ylqdivow.exe\"" 71efd5f8d2ad4c891d4d52f2cce17561_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3920 set thread context of 1468 3920 ylqdivow.exe 90 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 2720 1468 WerFault.exe 90 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 71efd5f8d2ad4c891d4d52f2cce17561_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ylqdivow.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 4320 wrote to memory of 3920 4320 71efd5f8d2ad4c891d4d52f2cce17561_JaffaCakes118.exe 88 PID 4320 wrote to memory of 3920 4320 71efd5f8d2ad4c891d4d52f2cce17561_JaffaCakes118.exe 88 PID 4320 wrote to memory of 3920 4320 71efd5f8d2ad4c891d4d52f2cce17561_JaffaCakes118.exe 88 PID 3920 wrote to memory of 1468 3920 ylqdivow.exe 90 PID 3920 wrote to memory of 1468 3920 ylqdivow.exe 90 PID 3920 wrote to memory of 1468 3920 ylqdivow.exe 90 PID 3920 wrote to memory of 1468 3920 ylqdivow.exe 90 PID 3920 wrote to memory of 1468 3920 ylqdivow.exe 90 PID 4320 wrote to memory of 2600 4320 71efd5f8d2ad4c891d4d52f2cce17561_JaffaCakes118.exe 95 PID 4320 wrote to memory of 2600 4320 71efd5f8d2ad4c891d4d52f2cce17561_JaffaCakes118.exe 95 PID 4320 wrote to memory of 2600 4320 71efd5f8d2ad4c891d4d52f2cce17561_JaffaCakes118.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\71efd5f8d2ad4c891d4d52f2cce17561_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\71efd5f8d2ad4c891d4d52f2cce17561_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Users\Admin\ylqdivow.exe"C:\Users\Admin\ylqdivow.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Windows\SysWOW64\svchost.exesvchost.exe3⤵
- System Location Discovery: System Language Discovery
PID:1468 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1468 -s 3564⤵
- Program crash
PID:2720
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\3081.bat" "2⤵
- System Location Discovery: System Language Discovery
PID:2600
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1468 -ip 14681⤵PID:3156
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
266B
MD59eea7abfb4d49faa6f8a741045e6ce12
SHA182300c781f27ed47fb876837e85d06aed51573ec
SHA256e48bf0d52c54ac76446b6a2ba61381d831fe120d33df23635ee6d8ff5c1c3687
SHA51282e6a16ec9550b8f63c60ed49e18a96110a42eca1eaece84b46d1a3f8064468be5b91de3464f6470612ae17f7d0f4933d0a61a49e96b9b4276f0bb11990636e9
-
Filesize
30.2MB
MD5c51a39bf1629cc6d4a56de883cd9e7a3
SHA128e47befdbf38565b0325ce4148bfb331fb10f20
SHA256dd1be538a4c761e5c25202b374e627042fa5967aa6be4d8fad94524c8af3abfd
SHA5126f02b9fe9b37e0f1b02ee2f40c14990c5a7bf918843dcfb6efc52bde74c0b5516d64ea67035c06aabe6318fc5f71555629d66978d767563d069c35806fb3d841