Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
04-11-2024 00:26
Behavioral task
behavioral1
Sample
8e3ea403df9de189ae02117cd58bde38_JaffaCakes118.exe
Resource
win7-20241010-en
General
-
Target
8e3ea403df9de189ae02117cd58bde38_JaffaCakes118.exe
-
Size
108KB
-
MD5
8e3ea403df9de189ae02117cd58bde38
-
SHA1
d80f2b2e5afa45505e72a9717462f38e989a966f
-
SHA256
7d8555bd5b2901dbabbf967f36c6e3e08456836efc7ce91ae48eb75dc23ab0d9
-
SHA512
83cca9358360383acf50b0477c1735a34e24ac2cfcea9df3fcb6c8d8f85f9d3880afd4b3d0fa4e1f1b8d789ef09fb1fad2d4e5b5be4882ea2f52d3ccc673fd53
-
SSDEEP
1536:3JoHHwAnTtIBcNCk+syhonfC3GNKcK7+sWjcd8sWL64TGFjb:4tCc+/h0fmSid81L64TGVb
Malware Config
Extracted
urelas
218.54.47.76
218.54.47.77
218.54.47.74
Signatures
-
Urelas family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation 8e3ea403df9de189ae02117cd58bde38_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 1224 biudfw.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8e3ea403df9de189ae02117cd58bde38_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language biudfw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4612 wrote to memory of 1224 4612 8e3ea403df9de189ae02117cd58bde38_JaffaCakes118.exe 87 PID 4612 wrote to memory of 1224 4612 8e3ea403df9de189ae02117cd58bde38_JaffaCakes118.exe 87 PID 4612 wrote to memory of 1224 4612 8e3ea403df9de189ae02117cd58bde38_JaffaCakes118.exe 87 PID 4612 wrote to memory of 1640 4612 8e3ea403df9de189ae02117cd58bde38_JaffaCakes118.exe 88 PID 4612 wrote to memory of 1640 4612 8e3ea403df9de189ae02117cd58bde38_JaffaCakes118.exe 88 PID 4612 wrote to memory of 1640 4612 8e3ea403df9de189ae02117cd58bde38_JaffaCakes118.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\8e3ea403df9de189ae02117cd58bde38_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8e3ea403df9de189ae02117cd58bde38_JaffaCakes118.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\biudfw.exe"C:\Users\Admin\AppData\Local\Temp\biudfw.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1224
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "2⤵
- System Location Discovery: System Language Discovery
PID:1640
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
108KB
MD50fbbacb724d0945c9a12882544988723
SHA1d5775dc2a631ea452bc5e3d4da98baaa0a51deab
SHA256e8a2a64b3c29f02db1b961762ed1ab12a46363ee0c5b582c87b7d5e7e3d56dd8
SHA5127e9f28807241b52e09aa1885399889c9ae30ebadcadb66c39d7a3be365a4a6345dd8b45e4d2c62d13490430ce401daf1ce0727917ec11c40ff63ef07585f2a2b
-
Filesize
512B
MD5429d29b7501cff75ffd4e7af0b24db41
SHA153808fde744d4d65aa2f4c48e8644a65f81be038
SHA2568076fa1dc4b0ecf16960cc5c92abd9dc5c4542fb7ff92073e8b6a24ba1eea1c7
SHA51283516d410586a6224af7cfc232b65d36a0e74e8c75264c737c20a9956aec011f1bd6343ad5b573219804cc8f76697a98b287d7117669e9375947fcfe49bd4e07
-
Filesize
302B
MD50817cb7228f849157bf82bda23580e80
SHA170d290fd3e4d99aba41577fce2e9160396a9be8f
SHA25645553da2ef6c66b56ed8091214566920fed73676cd071c76709da2caebd240b8
SHA51297ec27670af5bf87c55e280091818e48e73d7184022c5f133a6de407f128a86b0f7a9a5174612debe971384519681e0e7d0ab1ba79a89c0d0088abc85abca2e0