Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
31/10/2024, 02:44
Static task
static1
Behavioral task
behavioral1
Sample
8147c7099643d77c358cf75a3a63dfc5_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
8147c7099643d77c358cf75a3a63dfc5_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
8147c7099643d77c358cf75a3a63dfc5_JaffaCakes118.exe
-
Size
672KB
-
MD5
8147c7099643d77c358cf75a3a63dfc5
-
SHA1
3926b6f0272bc12ce843b5d4c0d805a05c8e7c67
-
SHA256
e7eca2bf91830d3461001744032be10b2d3cf730518e5b843cf673a4727a67c9
-
SHA512
693572243d1c6df5ddc537fea2b4bae947c95c7ed35d855e1167a8573c0142efef4e6ab55178844ba144520d75c250544c2b719bd1b8aa88ba0be7c6b071cada
-
SSDEEP
12288:5ndySpiT3Qi9HCv/QPd/tVR8OputzjF3Z4mxxDm6FSDZWcAIc+cD:R4gOAi9iHWkOYtjQmXDpEDRAY8
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation 1EXE~1.EXE -
Executes dropped EXE 3 IoCs
pid Process 3640 1EXE~1.EXE 3652 RunMgr.EXE 3384 fsdf.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 8147c7099643d77c358cf75a3a63dfc5_JaffaCakes118.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\RunMgr.EXE 1EXE~1.EXE File created C:\Windows\fsdf.exe RunMgr.EXE File opened for modification C:\Windows\fsdf.exe RunMgr.EXE File opened for modification C:\Windows\RunMgr.EXE RunMgr.EXE File created C:\Windows\uninstal.BAT RunMgr.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fsdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8147c7099643d77c358cf75a3a63dfc5_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1EXE~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RunMgr.EXE -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 3640 1EXE~1.EXE Token: SeDebugPrivilege 3652 RunMgr.EXE Token: SeDebugPrivilege 3384 fsdf.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3384 fsdf.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3796 wrote to memory of 3640 3796 8147c7099643d77c358cf75a3a63dfc5_JaffaCakes118.exe 84 PID 3796 wrote to memory of 3640 3796 8147c7099643d77c358cf75a3a63dfc5_JaffaCakes118.exe 84 PID 3796 wrote to memory of 3640 3796 8147c7099643d77c358cf75a3a63dfc5_JaffaCakes118.exe 84 PID 3640 wrote to memory of 3652 3640 1EXE~1.EXE 85 PID 3640 wrote to memory of 3652 3640 1EXE~1.EXE 85 PID 3640 wrote to memory of 3652 3640 1EXE~1.EXE 85 PID 3640 wrote to memory of 4276 3640 1EXE~1.EXE 86 PID 3640 wrote to memory of 4276 3640 1EXE~1.EXE 86 PID 3640 wrote to memory of 4276 3640 1EXE~1.EXE 86 PID 3640 wrote to memory of 2708 3640 1EXE~1.EXE 88 PID 3640 wrote to memory of 2708 3640 1EXE~1.EXE 88 PID 3640 wrote to memory of 2708 3640 1EXE~1.EXE 88 PID 3652 wrote to memory of 5004 3652 RunMgr.EXE 94 PID 3652 wrote to memory of 5004 3652 RunMgr.EXE 94 PID 3652 wrote to memory of 5004 3652 RunMgr.EXE 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\8147c7099643d77c358cf75a3a63dfc5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8147c7099643d77c358cf75a3a63dfc5_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1EXE~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1EXE~1.EXE2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Windows\RunMgr.EXE"C:\Windows\RunMgr.EXE"3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\uninstal.BAT4⤵
- System Location Discovery: System Language Discovery
PID:5004
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c del %SystemRoot%\Debug.exe3⤵
- System Location Discovery: System Language Discovery
PID:4276
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1EXE~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
PID:2708
-
-
-
C:\Windows\fsdf.exeC:\Windows\fsdf.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3384
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
332KB
MD57e88459b69c8e097c6db653af3a97f43
SHA1d97164aae8bf80b8fa94d9dfaecfba8f266abe8f
SHA256124a56123041af2df5af4d38c356dee0b61705d84cb4d6f1470305138aad1f06
SHA512ac0f436e90c68ab73aaa2befecf07265d0bef70651ed989b688b80caa517dec76e6745a293bf302674316dd0e4f3ea7f43371c6737f2bae8ff36170519205c1e
-
Filesize
280KB
MD5b71bb3319581724a2765e2a320dfb3b0
SHA10c9a35b863275bf605c64013bb3fa11c26a3f3d1
SHA2561ba8e4c48eb94f6fe21018c3064875756c67b4d9b908ff3167a2703f40cf8f19
SHA51294568ee0a1b3c242f5be6043760a7de6f49136bc70935b33caa0a80bd9702aebd52e0381efa4926fed2f9d2e903cc5cd27ee85a6f3b5c7f98466d183d89db0fd
-
Filesize
92B
MD510a77a8bff880d8c56bc4d878e7dc63c
SHA1d802f97e663c87517bf9de4faf2a4eedada1491e
SHA256b6969a0db11217adf76be053c7c88f8b44da393eeec554929b2f84831b52b708
SHA512473cb01ff9dc9bdd05f9f458188514bf92a6c6221ae4d4e8ad0b1a297d7d032c45e113d33eef8a05ca69cf307c64f4aca8607cba21f8aedbf02078bf71630d6b