Analysis
-
max time kernel
149s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
11/04/2025, 21:41
Static task
static1
General
-
Target
JaffaCakes118_afffaeef2329ab2660211ef1c0f1562b.exe
-
Size
488KB
-
MD5
afffaeef2329ab2660211ef1c0f1562b
-
SHA1
3ca3a64b88fbb94f5844cc854a15379a13e50c01
-
SHA256
70880891d2897ec408e56b4eac407ba1f339015871ea24b6807b9d7abb992534
-
SHA512
de29636e2f9d8c661bca68f1b415e314ef14898a9f22ce29e190e1e71a4ffd01fe0c9db8c2a9aed14e63749a7be8093ae3d885c6a0c52f8cb1bd09c3cf2ef3b8
-
SSDEEP
12288:NIXsgtvm1De5YlWx6lzBH46UmZMMMMM2MMMMM1:NU81ygBb7ZMMMMM2MMMMM1
Malware Config
Signatures
-
Pykspa family
-
Detect Pykspa worm 1 IoCs
resource yara_rule behavioral1/files/0x00090000000227af-4.dat family_pykspa -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation JaffaCakes118_afffaeef2329ab2660211ef1c0f1562b.exe -
Executes dropped EXE 2 IoCs
pid Process 1880 sdqaokddcna.exe 2532 sdqaokddcna.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 5620 1880 WerFault.exe 90 2676 2532 WerFault.exe 112 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_afffaeef2329ab2660211ef1c0f1562b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sdqaokddcna.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2720 JaffaCakes118_afffaeef2329ab2660211ef1c0f1562b.exe 2720 JaffaCakes118_afffaeef2329ab2660211ef1c0f1562b.exe 2720 JaffaCakes118_afffaeef2329ab2660211ef1c0f1562b.exe 2720 JaffaCakes118_afffaeef2329ab2660211ef1c0f1562b.exe 2720 JaffaCakes118_afffaeef2329ab2660211ef1c0f1562b.exe 2720 JaffaCakes118_afffaeef2329ab2660211ef1c0f1562b.exe 2720 JaffaCakes118_afffaeef2329ab2660211ef1c0f1562b.exe 2720 JaffaCakes118_afffaeef2329ab2660211ef1c0f1562b.exe 2720 JaffaCakes118_afffaeef2329ab2660211ef1c0f1562b.exe 2720 JaffaCakes118_afffaeef2329ab2660211ef1c0f1562b.exe 2720 JaffaCakes118_afffaeef2329ab2660211ef1c0f1562b.exe 2720 JaffaCakes118_afffaeef2329ab2660211ef1c0f1562b.exe 2720 JaffaCakes118_afffaeef2329ab2660211ef1c0f1562b.exe 2720 JaffaCakes118_afffaeef2329ab2660211ef1c0f1562b.exe 2720 JaffaCakes118_afffaeef2329ab2660211ef1c0f1562b.exe 2720 JaffaCakes118_afffaeef2329ab2660211ef1c0f1562b.exe 2720 JaffaCakes118_afffaeef2329ab2660211ef1c0f1562b.exe 2720 JaffaCakes118_afffaeef2329ab2660211ef1c0f1562b.exe 2720 JaffaCakes118_afffaeef2329ab2660211ef1c0f1562b.exe 2720 JaffaCakes118_afffaeef2329ab2660211ef1c0f1562b.exe 2720 JaffaCakes118_afffaeef2329ab2660211ef1c0f1562b.exe 2720 JaffaCakes118_afffaeef2329ab2660211ef1c0f1562b.exe 2720 JaffaCakes118_afffaeef2329ab2660211ef1c0f1562b.exe 2720 JaffaCakes118_afffaeef2329ab2660211ef1c0f1562b.exe 2720 JaffaCakes118_afffaeef2329ab2660211ef1c0f1562b.exe 2720 JaffaCakes118_afffaeef2329ab2660211ef1c0f1562b.exe 2720 JaffaCakes118_afffaeef2329ab2660211ef1c0f1562b.exe 2720 JaffaCakes118_afffaeef2329ab2660211ef1c0f1562b.exe 2720 JaffaCakes118_afffaeef2329ab2660211ef1c0f1562b.exe 2720 JaffaCakes118_afffaeef2329ab2660211ef1c0f1562b.exe 2720 JaffaCakes118_afffaeef2329ab2660211ef1c0f1562b.exe 2720 JaffaCakes118_afffaeef2329ab2660211ef1c0f1562b.exe 2720 JaffaCakes118_afffaeef2329ab2660211ef1c0f1562b.exe 2720 JaffaCakes118_afffaeef2329ab2660211ef1c0f1562b.exe 2720 JaffaCakes118_afffaeef2329ab2660211ef1c0f1562b.exe 2720 JaffaCakes118_afffaeef2329ab2660211ef1c0f1562b.exe 2720 JaffaCakes118_afffaeef2329ab2660211ef1c0f1562b.exe 2720 JaffaCakes118_afffaeef2329ab2660211ef1c0f1562b.exe 2720 JaffaCakes118_afffaeef2329ab2660211ef1c0f1562b.exe 2720 JaffaCakes118_afffaeef2329ab2660211ef1c0f1562b.exe 2720 JaffaCakes118_afffaeef2329ab2660211ef1c0f1562b.exe 2720 JaffaCakes118_afffaeef2329ab2660211ef1c0f1562b.exe 2720 JaffaCakes118_afffaeef2329ab2660211ef1c0f1562b.exe 2720 JaffaCakes118_afffaeef2329ab2660211ef1c0f1562b.exe 2720 JaffaCakes118_afffaeef2329ab2660211ef1c0f1562b.exe 2720 JaffaCakes118_afffaeef2329ab2660211ef1c0f1562b.exe 2720 JaffaCakes118_afffaeef2329ab2660211ef1c0f1562b.exe 2720 JaffaCakes118_afffaeef2329ab2660211ef1c0f1562b.exe 2720 JaffaCakes118_afffaeef2329ab2660211ef1c0f1562b.exe 2720 JaffaCakes118_afffaeef2329ab2660211ef1c0f1562b.exe 2720 JaffaCakes118_afffaeef2329ab2660211ef1c0f1562b.exe 2720 JaffaCakes118_afffaeef2329ab2660211ef1c0f1562b.exe 2720 JaffaCakes118_afffaeef2329ab2660211ef1c0f1562b.exe 2720 JaffaCakes118_afffaeef2329ab2660211ef1c0f1562b.exe 2720 JaffaCakes118_afffaeef2329ab2660211ef1c0f1562b.exe 2720 JaffaCakes118_afffaeef2329ab2660211ef1c0f1562b.exe 2720 JaffaCakes118_afffaeef2329ab2660211ef1c0f1562b.exe 2720 JaffaCakes118_afffaeef2329ab2660211ef1c0f1562b.exe 2720 JaffaCakes118_afffaeef2329ab2660211ef1c0f1562b.exe 2720 JaffaCakes118_afffaeef2329ab2660211ef1c0f1562b.exe 2720 JaffaCakes118_afffaeef2329ab2660211ef1c0f1562b.exe 2720 JaffaCakes118_afffaeef2329ab2660211ef1c0f1562b.exe 2720 JaffaCakes118_afffaeef2329ab2660211ef1c0f1562b.exe 2720 JaffaCakes118_afffaeef2329ab2660211ef1c0f1562b.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2720 wrote to memory of 1880 2720 JaffaCakes118_afffaeef2329ab2660211ef1c0f1562b.exe 90 PID 2720 wrote to memory of 1880 2720 JaffaCakes118_afffaeef2329ab2660211ef1c0f1562b.exe 90 PID 2720 wrote to memory of 1880 2720 JaffaCakes118_afffaeef2329ab2660211ef1c0f1562b.exe 90 PID 2720 wrote to memory of 2532 2720 JaffaCakes118_afffaeef2329ab2660211ef1c0f1562b.exe 112 PID 2720 wrote to memory of 2532 2720 JaffaCakes118_afffaeef2329ab2660211ef1c0f1562b.exe 112 PID 2720 wrote to memory of 2532 2720 JaffaCakes118_afffaeef2329ab2660211ef1c0f1562b.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_afffaeef2329ab2660211ef1c0f1562b.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_afffaeef2329ab2660211ef1c0f1562b.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\sdqaokddcna.exe"C:\Users\Admin\AppData\Local\Temp\sdqaokddcna.exe" "c:\users\admin\appdata\local\temp\jaffacakes118_afffaeef2329ab2660211ef1c0f1562b.exe*"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1880 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1880 -s 3483⤵
- Program crash
PID:5620
-
-
-
C:\Users\Admin\AppData\Local\Temp\sdqaokddcna.exe"C:\Users\Admin\AppData\Local\Temp\sdqaokddcna.exe" "c:\users\admin\appdata\local\temp\jaffacakes118_afffaeef2329ab2660211ef1c0f1562b.exe"2⤵
- Executes dropped EXE
PID:2532 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2532 -s 3123⤵
- Program crash
PID:2676
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1880 -ip 18801⤵PID:4780
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2532 -ip 25321⤵PID:5700
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
320KB
MD50a9c62dc48670cd0a88a7ff334e67799
SHA189ab1d31ffa5ab73361e8448ac9393f40bef08a8
SHA2565701be62296551688c2da1a97f2fc92d43289cb0aa1280dd5f41c968f88d5654
SHA5127ff0c62e7b1bfb516476a570e015bff6e573b7a272b1cd25f32cc01d109ae58014c03a6f9a9f9be7b09620db4132fbe19186ebdef9c451e59d6f29b848153a6b