Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
31/10/2024, 12:06
Static task
static1
Behavioral task
behavioral1
Sample
82f63475190e543b9c5d79d24bd6e91d_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
82f63475190e543b9c5d79d24bd6e91d_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
82f63475190e543b9c5d79d24bd6e91d_JaffaCakes118.exe
-
Size
1.2MB
-
MD5
82f63475190e543b9c5d79d24bd6e91d
-
SHA1
994fde79084e532203a1e473e71253a475598bb2
-
SHA256
62e216ea83a6de60dc7439dfbe521d8a3d37cd6f2917ba06edf2b0da2e3fdcf9
-
SHA512
dac98ca8409de3ed656d1ca106b1e31ec7e7d02c6fc55a3ef213872b5d7445f136adc6d7cc3a9118330e56ab3eff207c2a6dbf89b9817afd6e828682a8575375
-
SSDEEP
24576:jh5bXVxQ2CeV6vNJAp7ElVVwoRPyBlDSpAj6+Uip5BBNMd:t5rQ2MNHhwoRPQ+Aj6+U2q
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 82f63475190e543b9c5d79d24bd6e91d_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 82f63475190e543b9c5d79d24bd6e91d_JaffaCakes118.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation 82f63475190e543b9c5d79d24bd6e91d_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 968 Terjemah Al-Quran.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82f63475190e543b9c5d79d24bd6e91d_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Terjemah Al-Quran.exe -
Modifies registry class 13 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E7B2DC82-970B-039B-970B-039B970B039B}\Version 82f63475190e543b9c5d79d24bd6e91d_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E7B2DC82-970B-039B-970B-039B970B039B}\Version\ = "1.0" 82f63475190e543b9c5d79d24bd6e91d_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E7B2DC82-970B-039B-970B-039B970B039B}\VersionIndependentProgID 82f63475190e543b9c5d79d24bd6e91d_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E7B2DC82-970B-039B-970B-039B970B039B}\InprocServer32\ThreadingModel = "Apartment" 82f63475190e543b9c5d79d24bd6e91d_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E7B2DC82-970B-039B-970B-039B970B039B}\ProgID 82f63475190e543b9c5d79d24bd6e91d_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E7B2DC82-970B-039B-970B-039B970B039B}\TypeLib 82f63475190e543b9c5d79d24bd6e91d_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E7B2DC82-970B-039B-970B-039B970B039B}\TypeLib\ = "{00f25ae8-3625-4e34-92d4-f0918cf010ee}" 82f63475190e543b9c5d79d24bd6e91d_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E7B2DC82-970B-039B-970B-039B970B039B}\ProgID\ = "Microsoft.PhotoAcquire.1" 82f63475190e543b9c5d79d24bd6e91d_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E7B2DC82-970B-039B-970B-039B970B039B}\VersionIndependentProgID\ = "Microsoft.PhotoAcquire" 82f63475190e543b9c5d79d24bd6e91d_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E7B2DC82-970B-039B-970B-039B970B039B} 82f63475190e543b9c5d79d24bd6e91d_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E7B2DC82-970B-039B-970B-039B970B039B}\ = "PhotoAcquire" 82f63475190e543b9c5d79d24bd6e91d_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E7B2DC82-970B-039B-970B-039B970B039B}\InprocServer32 82f63475190e543b9c5d79d24bd6e91d_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E7B2DC82-970B-039B-970B-039B970B039B}\InprocServer32\ = "%ProgramFiles(x86)%\\Windows Photo Viewer\\PhotoAcq.dll" 82f63475190e543b9c5d79d24bd6e91d_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 624 82f63475190e543b9c5d79d24bd6e91d_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 624 82f63475190e543b9c5d79d24bd6e91d_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 624 wrote to memory of 968 624 82f63475190e543b9c5d79d24bd6e91d_JaffaCakes118.exe 87 PID 624 wrote to memory of 968 624 82f63475190e543b9c5d79d24bd6e91d_JaffaCakes118.exe 87 PID 624 wrote to memory of 968 624 82f63475190e543b9c5d79d24bd6e91d_JaffaCakes118.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\82f63475190e543b9c5d79d24bd6e91d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82f63475190e543b9c5d79d24bd6e91d_JaffaCakes118.exe"1⤵
- Checks BIOS information in registry
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Users\Admin\AppData\Roaming\Terjemah Al-Quran.exe"C:\Users\Admin\AppData\Roaming\Terjemah Al-Quran.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:968
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
321KB
MD544d93b216554246161fae3c68f790ee8
SHA1de9fa5b712d2aa2d16c56a539823f2d1b90c3a7b
SHA25656d018d187c245539c8f6078ee7b76f8cc55fd0cf3e1142c766380adfc80ed86
SHA512524bfe37b57053857ca3fcc9b543303af90b5365c120253d45ba88bf5bf5a8596747e0f951f524d3fdb6afdaf899094ae7ceb06f454667170daa87a0a7bf3c21