Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10-01-2025 13:43
Behavioral task
behavioral1
Sample
JaffaCakes118_e5b8188379f0b45c15b9d0bf084181f6.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
JaffaCakes118_e5b8188379f0b45c15b9d0bf084181f6.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_e5b8188379f0b45c15b9d0bf084181f6.exe
-
Size
224KB
-
MD5
e5b8188379f0b45c15b9d0bf084181f6
-
SHA1
91518827a2d9a1ff1a1a12a619a43c5206344576
-
SHA256
12df5f115fa6663fd4408d4064499eb7a3f3610b6ce76809484183c49241e1e4
-
SHA512
c3feb253378a36a238efa220bc77c8a215404f3066d598a9343bc356a0207ad2c4413565c3fbe258324a870bfb809bee2ffde8d5cf38daaa18257030040ba5be
-
SSDEEP
3072:vHjk+0oLnWFnzBHv/xWFsg8WatFBGFVWPE5ac0pG/1z+QVMbg1jm0+J:Po/BHng5HaVG4G/1z+QVMbg1jv+
Malware Config
Signatures
-
Vobfus family
-
Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run JaffaCakes118_e5b8188379f0b45c15b9d0bf084181f6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\VLXHCMT5KJ = "C:\\Users\\Admin\\AppData\\Roaming\\AG58FPQON.exe" JaffaCakes118_e5b8188379f0b45c15b9d0bf084181f6.exe Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run JaffaCakes118_e5b8188379f0b45c15b9d0bf084181f6.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\VLXHCMT5KJ = "C:\\Users\\Admin\\AppData\\Roaming\\AG58FPQON.exe" JaffaCakes118_e5b8188379f0b45c15b9d0bf084181f6.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VLXHCMT5KJ = "C:\\Users\\Admin\\AppData\\Roaming\\AG58FPQON.exe" JaffaCakes118_e5b8188379f0b45c15b9d0bf084181f6.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VLXHCMT5KJ = "C:\\Users\\Admin\\AppData\\Roaming\\AG58FPQON.exe" JaffaCakes118_e5b8188379f0b45c15b9d0bf084181f6.exe -
resource yara_rule behavioral2/memory/4784-0-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/files/0x000c000000023b19-7.dat upx behavioral2/memory/4784-17-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/4784-18-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/4784-232-0x0000000000400000-0x0000000000437000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_e5b8188379f0b45c15b9d0bf084181f6.exe -
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 14 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 44 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4784 JaffaCakes118_e5b8188379f0b45c15b9d0bf084181f6.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 4784 JaffaCakes118_e5b8188379f0b45c15b9d0bf084181f6.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4784 JaffaCakes118_e5b8188379f0b45c15b9d0bf084181f6.exe 4784 JaffaCakes118_e5b8188379f0b45c15b9d0bf084181f6.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e5b8188379f0b45c15b9d0bf084181f6.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e5b8188379f0b45c15b9d0bf084181f6.exe"1⤵
- Adds policy Run key to start application
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
PID:4784
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
224KB
MD52ab9b9bff2451d8a6463966176a248d0
SHA13fd8e0a9b8161a88a1800ed7399f829ccd3760c0
SHA2560ba421e4750f90869d9b7af74e555e652190e444f2d3c0a079eff47c6be361a9
SHA512bca74ab28f1883a895cba0344efbe26f2f94c9a1c1b3201f973d4a1aac65a6ed4b60ef27d1c2b6743d8197cd513f8caae1fe185ab9a9cc3979a7a7005fb488d7