Analysis
-
max time kernel
94s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
09-05-2024 16:59
Static task
static1
Behavioral task
behavioral1
Sample
2af5a00d00befdcbc1a04d8a993ddfeb_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2af5a00d00befdcbc1a04d8a993ddfeb_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
2af5a00d00befdcbc1a04d8a993ddfeb_JaffaCakes118.exe
-
Size
227KB
-
MD5
2af5a00d00befdcbc1a04d8a993ddfeb
-
SHA1
838211204c6a17149aa027882d4be61c4b29ce33
-
SHA256
4ce6cd07bcac1f637e4b5202c91957d3b3d0f77c19dbe53e0ef30f7baf766f39
-
SHA512
866efcf751fe16d1607a17d16248b9bf68127f455a90c485628d7d45fce7155b705b38882e6bad83c9c926b5fad3189914e08312aa775b481678daf5dd5fc97b
-
SSDEEP
6144:/XPJatRoWtse+j/NZTEO4qyEKI7NvS/LBDqB54XB:JMWWtx8jrBNKlD64XB
Malware Config
Extracted
gcleaner
gc-partners.in
Signatures
-
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
-
OnlyLogger payload 5 IoCs
Processes:
resource yara_rule behavioral2/memory/1968-2-0x0000000000FA0000-0x0000000000FE6000-memory.dmp family_onlylogger behavioral2/memory/1968-3-0x0000000000400000-0x0000000000449000-memory.dmp family_onlylogger behavioral2/memory/1968-6-0x0000000000400000-0x0000000000449000-memory.dmp family_onlylogger behavioral2/memory/1968-5-0x0000000000FA0000-0x0000000000FE6000-memory.dmp family_onlylogger behavioral2/memory/1968-4-0x0000000000400000-0x0000000000F96000-memory.dmp family_onlylogger -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
2af5a00d00befdcbc1a04d8a993ddfeb_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation 2af5a00d00befdcbc1a04d8a993ddfeb_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4936 1968 WerFault.exe 2af5a00d00befdcbc1a04d8a993ddfeb_JaffaCakes118.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 4724 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 4724 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
2af5a00d00befdcbc1a04d8a993ddfeb_JaffaCakes118.execmd.exedescription pid process target process PID 1968 wrote to memory of 1028 1968 2af5a00d00befdcbc1a04d8a993ddfeb_JaffaCakes118.exe cmd.exe PID 1968 wrote to memory of 1028 1968 2af5a00d00befdcbc1a04d8a993ddfeb_JaffaCakes118.exe cmd.exe PID 1968 wrote to memory of 1028 1968 2af5a00d00befdcbc1a04d8a993ddfeb_JaffaCakes118.exe cmd.exe PID 1028 wrote to memory of 4724 1028 cmd.exe taskkill.exe PID 1028 wrote to memory of 4724 1028 cmd.exe taskkill.exe PID 1028 wrote to memory of 4724 1028 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2af5a00d00befdcbc1a04d8a993ddfeb_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2af5a00d00befdcbc1a04d8a993ddfeb_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "2af5a00d00befdcbc1a04d8a993ddfeb_JaffaCakes118.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\2af5a00d00befdcbc1a04d8a993ddfeb_JaffaCakes118.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "2af5a00d00befdcbc1a04d8a993ddfeb_JaffaCakes118.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 12722⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1968 -ip 19681⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1968-1-0x0000000001160000-0x0000000001260000-memory.dmpFilesize
1024KB
-
memory/1968-2-0x0000000000FA0000-0x0000000000FE6000-memory.dmpFilesize
280KB
-
memory/1968-3-0x0000000000400000-0x0000000000449000-memory.dmpFilesize
292KB
-
memory/1968-6-0x0000000000400000-0x0000000000449000-memory.dmpFilesize
292KB
-
memory/1968-5-0x0000000000FA0000-0x0000000000FE6000-memory.dmpFilesize
280KB
-
memory/1968-4-0x0000000000400000-0x0000000000F96000-memory.dmpFilesize
11.6MB