Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
02-12-2024 08:55
Static task
static1
Behavioral task
behavioral1
Sample
b7d610ea84da74ede9f9dfeab88f8475_JaffaCakes118.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
b7d610ea84da74ede9f9dfeab88f8475_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
b7d610ea84da74ede9f9dfeab88f8475_JaffaCakes118.exe
-
Size
339KB
-
MD5
b7d610ea84da74ede9f9dfeab88f8475
-
SHA1
852d7c21e13e6fa5fc2a58941d926af734e02959
-
SHA256
fa83eba7e3b3197c422823db67eb3ce509293eda358b29536cec627aa424865c
-
SHA512
4f2270efc792598c1f21f0d44840ca6cdcfe7757a6e3d938db2e10689a216cbe5f49a32ec54ad416669a04d8ade92e38511533be90090d964f46df1adb16abfa
-
SSDEEP
6144:6H79ve/t8CucAkoJNNABqA3dg23C5IPTOphn7B4FjKiSM+Xb:6H79veiCunjNctggCqqpd9UH7
Malware Config
Extracted
gcleaner
gcl-page.biz
194.145.227.161
Signatures
-
Gcleaner family
-
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
-
Onlylogger family
-
OnlyLogger payload 5 IoCs
resource yara_rule behavioral2/memory/780-2-0x0000000000E60000-0x0000000000EA8000-memory.dmp family_onlylogger behavioral2/memory/780-3-0x0000000000400000-0x000000000044B000-memory.dmp family_onlylogger behavioral2/memory/780-6-0x0000000000400000-0x000000000044B000-memory.dmp family_onlylogger behavioral2/memory/780-5-0x0000000000E60000-0x0000000000EA8000-memory.dmp family_onlylogger behavioral2/memory/780-4-0x0000000000400000-0x0000000000885000-memory.dmp family_onlylogger -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation b7d610ea84da74ede9f9dfeab88f8475_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 6 IoCs
pid pid_target Process procid_target 2480 780 WerFault.exe 82 2996 780 WerFault.exe 82 2180 780 WerFault.exe 82 1636 780 WerFault.exe 82 2668 780 WerFault.exe 82 5100 780 WerFault.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b7d610ea84da74ede9f9dfeab88f8475_JaffaCakes118.exe -
Kills process with taskkill 1 IoCs
pid Process 4800 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4800 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 780 wrote to memory of 1852 780 b7d610ea84da74ede9f9dfeab88f8475_JaffaCakes118.exe 103 PID 780 wrote to memory of 1852 780 b7d610ea84da74ede9f9dfeab88f8475_JaffaCakes118.exe 103 PID 780 wrote to memory of 1852 780 b7d610ea84da74ede9f9dfeab88f8475_JaffaCakes118.exe 103 PID 1852 wrote to memory of 4800 1852 cmd.exe 105 PID 1852 wrote to memory of 4800 1852 cmd.exe 105 PID 1852 wrote to memory of 4800 1852 cmd.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\b7d610ea84da74ede9f9dfeab88f8475_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b7d610ea84da74ede9f9dfeab88f8475_JaffaCakes118.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:780 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 780 -s 7362⤵
- Program crash
PID:2480
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 780 -s 7842⤵
- Program crash
PID:2996
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 780 -s 7922⤵
- Program crash
PID:2180
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 780 -s 7762⤵
- Program crash
PID:1636
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 780 -s 7922⤵
- Program crash
PID:2668
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 780 -s 9762⤵
- Program crash
PID:5100
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "b7d610ea84da74ede9f9dfeab88f8475_JaffaCakes118.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\b7d610ea84da74ede9f9dfeab88f8475_JaffaCakes118.exe" & exit2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "b7d610ea84da74ede9f9dfeab88f8475_JaffaCakes118.exe" /f3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4800
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 780 -ip 7801⤵PID:4740
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 780 -ip 7801⤵PID:3096
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 780 -ip 7801⤵PID:4936
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 780 -ip 7801⤵PID:3932
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 780 -ip 7801⤵PID:3996
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 780 -ip 7801⤵PID:2588