Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18-12-2024 22:54
Static task
static1
Behavioral task
behavioral1
Sample
fd6f2d6431adc8ab79ef69616b9b756a_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fd6f2d6431adc8ab79ef69616b9b756a_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
fd6f2d6431adc8ab79ef69616b9b756a_JaffaCakes118.exe
-
Size
285KB
-
MD5
fd6f2d6431adc8ab79ef69616b9b756a
-
SHA1
061bf41849559a21f667cf4289ca5cd32fcca9da
-
SHA256
d3cbcf7224c5cd688e665238b91e2b0249c175d6238af31398308e7ecb226cb9
-
SHA512
a1521b76a706888d14c16a388995f75dd5422c4bb317a9887bced337dcf2f34217ca74a3ea0f350321f0b270e27fa021e8382a96b0d0cad1a4d9dec4bffdc19d
-
SSDEEP
6144:iw2nNVPt9knkBGvINhmjVss4ocL4hL1NZh:iw2nNVnkndIn42hocknv
Malware Config
Extracted
gcleaner
gcl-page.biz
194.145.227.161
Signatures
-
Gcleaner family
-
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
-
Onlylogger family
-
OnlyLogger payload 5 IoCs
resource yara_rule behavioral2/memory/4356-2-0x00000000009C0000-0x00000000009EF000-memory.dmp family_onlylogger behavioral2/memory/4356-3-0x0000000000400000-0x0000000000431000-memory.dmp family_onlylogger behavioral2/memory/4356-12-0x0000000000400000-0x0000000000431000-memory.dmp family_onlylogger behavioral2/memory/4356-10-0x0000000000400000-0x0000000000877000-memory.dmp family_onlylogger behavioral2/memory/4356-11-0x00000000009C0000-0x00000000009EF000-memory.dmp family_onlylogger -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation fd6f2d6431adc8ab79ef69616b9b756a_JaffaCakes118.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 18 iplogger.org 20 iplogger.org -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 13 IoCs
pid pid_target Process procid_target 2012 4356 WerFault.exe 82 2984 4356 WerFault.exe 82 3436 4356 WerFault.exe 82 4760 4356 WerFault.exe 82 2260 4356 WerFault.exe 82 4984 4356 WerFault.exe 82 1508 4356 WerFault.exe 82 4868 4356 WerFault.exe 82 2928 4356 WerFault.exe 82 3544 4356 WerFault.exe 82 1544 4356 WerFault.exe 82 4168 4356 WerFault.exe 82 4976 4356 WerFault.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fd6f2d6431adc8ab79ef69616b9b756a_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe -
Kills process with taskkill 1 IoCs
pid Process 1124 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1124 taskkill.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 4356 wrote to memory of 1780 4356 fd6f2d6431adc8ab79ef69616b9b756a_JaffaCakes118.exe 104 PID 4356 wrote to memory of 1780 4356 fd6f2d6431adc8ab79ef69616b9b756a_JaffaCakes118.exe 104 PID 4356 wrote to memory of 1780 4356 fd6f2d6431adc8ab79ef69616b9b756a_JaffaCakes118.exe 104 PID 4356 wrote to memory of 1720 4356 fd6f2d6431adc8ab79ef69616b9b756a_JaffaCakes118.exe 106 PID 4356 wrote to memory of 1720 4356 fd6f2d6431adc8ab79ef69616b9b756a_JaffaCakes118.exe 106 PID 4356 wrote to memory of 1720 4356 fd6f2d6431adc8ab79ef69616b9b756a_JaffaCakes118.exe 106 PID 4356 wrote to memory of 4632 4356 fd6f2d6431adc8ab79ef69616b9b756a_JaffaCakes118.exe 108 PID 4356 wrote to memory of 4632 4356 fd6f2d6431adc8ab79ef69616b9b756a_JaffaCakes118.exe 108 PID 4356 wrote to memory of 4632 4356 fd6f2d6431adc8ab79ef69616b9b756a_JaffaCakes118.exe 108 PID 4356 wrote to memory of 228 4356 fd6f2d6431adc8ab79ef69616b9b756a_JaffaCakes118.exe 114 PID 4356 wrote to memory of 228 4356 fd6f2d6431adc8ab79ef69616b9b756a_JaffaCakes118.exe 114 PID 4356 wrote to memory of 228 4356 fd6f2d6431adc8ab79ef69616b9b756a_JaffaCakes118.exe 114 PID 228 wrote to memory of 1124 228 cmd.exe 118 PID 228 wrote to memory of 1124 228 cmd.exe 118 PID 228 wrote to memory of 1124 228 cmd.exe 118
Processes
-
C:\Users\Admin\AppData\Local\Temp\fd6f2d6431adc8ab79ef69616b9b756a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fd6f2d6431adc8ab79ef69616b9b756a_JaffaCakes118.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4356 -s 5162⤵
- Program crash
PID:2012
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4356 -s 6522⤵
- Program crash
PID:2984
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4356 -s 6962⤵
- Program crash
PID:3436
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4356 -s 8322⤵
- Program crash
PID:4760
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4356 -s 9522⤵
- Program crash
PID:2260
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4356 -s 9842⤵
- Program crash
PID:4984
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4356 -s 9922⤵
- Program crash
PID:1508
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4356 -s 11922⤵
- Program crash
PID:4868
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4356 -s 12362⤵
- Program crash
PID:2928
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4356 -s 16242⤵
- Program crash
PID:3544
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{urQW-UIheE-6e7E-WGXM1}\37576032644.exe"2⤵
- System Location Discovery: System Language Discovery
PID:1780
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{urQW-UIheE-6e7E-WGXM1}\37836396633.exe" /mix2⤵
- System Location Discovery: System Language Discovery
PID:1720
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{urQW-UIheE-6e7E-WGXM1}\55353344421.exe" /mix2⤵
- System Location Discovery: System Language Discovery
PID:4632
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4356 -s 17522⤵
- Program crash
PID:1544
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4356 -s 18162⤵
- Program crash
PID:4168
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "fd6f2d6431adc8ab79ef69616b9b756a_JaffaCakes118.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\fd6f2d6431adc8ab79ef69616b9b756a_JaffaCakes118.exe" & exit2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:228 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "fd6f2d6431adc8ab79ef69616b9b756a_JaffaCakes118.exe" /f3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1124
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4356 -s 16362⤵
- Program crash
PID:4976
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4356 -ip 43561⤵PID:912
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4356 -ip 43561⤵PID:5016
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4356 -ip 43561⤵PID:4440
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4356 -ip 43561⤵PID:4980
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4356 -ip 43561⤵PID:2304
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4356 -ip 43561⤵PID:4036
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4356 -ip 43561⤵PID:4736
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4356 -ip 43561⤵PID:4732
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4356 -ip 43561⤵PID:3988
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4356 -ip 43561⤵PID:2568
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4356 -ip 43561⤵PID:3472
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4356 -ip 43561⤵PID:3944
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4356 -ip 43561⤵PID:964
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
277B
MD56445250d234e789c0c2afe69f119e326
SHA103074f75c0ff50783d8c2e32d96e39b746540f66
SHA2562e6cd9433e66a9ebde268bc6949d4660de441790bd39ffc9cb0f4caaeb44320f
SHA512ecd094a4d026378f85435f8a2dc16c92c033aff92ba126d8bbb22d6b279b842d417f4df0f63199ea248d0ec64b9679acb5a1f835560d8e3c5b84be492cc0e68e