Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
10-06-2024 15:43
Static task
static1
Behavioral task
behavioral1
Sample
9b3250409072ce5b4e4bc467f29102d2_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
9b3250409072ce5b4e4bc467f29102d2_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
9b3250409072ce5b4e4bc467f29102d2_JaffaCakes118.exe
-
Size
612KB
-
MD5
9b3250409072ce5b4e4bc467f29102d2
-
SHA1
86a2fad69241a68a129c25531d5aea8ba2304bc3
-
SHA256
24f089cd7b8348eea7f18b3d69fe7bd4d000f1a4c2ba7889a5e133e9862cc1e2
-
SHA512
e7101b2f5d63410920d3b58e2c12ca00edba1351aa7d31cfa139af49f21f25fe328c0e446ee2885b046ca52083dfb012a6ea7555d86c098287dc1ff91d89b31f
-
SSDEEP
12288:RfEKhhYNpXXreuGFzpY2zkF9a37WSTUE8vcbI91BntKpzRrYBMKj:RcKMNpHqDJhLu35DzKJd
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
9b3250409072ce5b4e4bc467f29102d2_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation 9b3250409072ce5b4e4bc467f29102d2_JaffaCakes118.exe -
Executes dropped EXE 2 IoCs
Processes:
9b3250409072ce5b4e4bc467f29102d2_jaffacakes118.exe9b3250409072ce5b4e4bc467f29102d2_jaffacakes118.exepid process 4468 9b3250409072ce5b4e4bc467f29102d2_jaffacakes118.exe 3204 9b3250409072ce5b4e4bc467f29102d2_jaffacakes118.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
9b3250409072ce5b4e4bc467f29102d2_jaffacakes118.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winstartcdb = "C:\\Users\\Admin\\AppData\\Roaming\\defenderstcdb\\winlogimdecdb.exe" 9b3250409072ce5b4e4bc467f29102d2_jaffacakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winstartcdb = "\\defenderstcdb\\winlogimdecdb.exe" 9b3250409072ce5b4e4bc467f29102d2_jaffacakes118.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
9b3250409072ce5b4e4bc467f29102d2_JaffaCakes118.exe9b3250409072ce5b4e4bc467f29102d2_jaffacakes118.exedescription pid process target process PID 4536 set thread context of 4500 4536 9b3250409072ce5b4e4bc467f29102d2_JaffaCakes118.exe 9b3250409072ce5b4e4bc467f29102d2_JaffaCakes118.exe PID 4468 set thread context of 3204 4468 9b3250409072ce5b4e4bc467f29102d2_jaffacakes118.exe 9b3250409072ce5b4e4bc467f29102d2_jaffacakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
9b3250409072ce5b4e4bc467f29102d2_jaffacakes118.exepid process 3204 9b3250409072ce5b4e4bc467f29102d2_jaffacakes118.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
9b3250409072ce5b4e4bc467f29102d2_JaffaCakes118.exe9b3250409072ce5b4e4bc467f29102d2_JaffaCakes118.exe9b3250409072ce5b4e4bc467f29102d2_jaffacakes118.exe9b3250409072ce5b4e4bc467f29102d2_jaffacakes118.exedescription pid process Token: SeDebugPrivilege 4536 9b3250409072ce5b4e4bc467f29102d2_JaffaCakes118.exe Token: SeDebugPrivilege 4500 9b3250409072ce5b4e4bc467f29102d2_JaffaCakes118.exe Token: SeDebugPrivilege 4468 9b3250409072ce5b4e4bc467f29102d2_jaffacakes118.exe Token: SeDebugPrivilege 3204 9b3250409072ce5b4e4bc467f29102d2_jaffacakes118.exe Token: 33 3204 9b3250409072ce5b4e4bc467f29102d2_jaffacakes118.exe Token: SeIncBasePriorityPrivilege 3204 9b3250409072ce5b4e4bc467f29102d2_jaffacakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
9b3250409072ce5b4e4bc467f29102d2_jaffacakes118.exepid process 3204 9b3250409072ce5b4e4bc467f29102d2_jaffacakes118.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
9b3250409072ce5b4e4bc467f29102d2_JaffaCakes118.exe9b3250409072ce5b4e4bc467f29102d2_JaffaCakes118.execmd.exe9b3250409072ce5b4e4bc467f29102d2_jaffacakes118.exedescription pid process target process PID 4536 wrote to memory of 4500 4536 9b3250409072ce5b4e4bc467f29102d2_JaffaCakes118.exe 9b3250409072ce5b4e4bc467f29102d2_JaffaCakes118.exe PID 4536 wrote to memory of 4500 4536 9b3250409072ce5b4e4bc467f29102d2_JaffaCakes118.exe 9b3250409072ce5b4e4bc467f29102d2_JaffaCakes118.exe PID 4536 wrote to memory of 4500 4536 9b3250409072ce5b4e4bc467f29102d2_JaffaCakes118.exe 9b3250409072ce5b4e4bc467f29102d2_JaffaCakes118.exe PID 4536 wrote to memory of 4500 4536 9b3250409072ce5b4e4bc467f29102d2_JaffaCakes118.exe 9b3250409072ce5b4e4bc467f29102d2_JaffaCakes118.exe PID 4536 wrote to memory of 4500 4536 9b3250409072ce5b4e4bc467f29102d2_JaffaCakes118.exe 9b3250409072ce5b4e4bc467f29102d2_JaffaCakes118.exe PID 4536 wrote to memory of 4500 4536 9b3250409072ce5b4e4bc467f29102d2_JaffaCakes118.exe 9b3250409072ce5b4e4bc467f29102d2_JaffaCakes118.exe PID 4536 wrote to memory of 4500 4536 9b3250409072ce5b4e4bc467f29102d2_JaffaCakes118.exe 9b3250409072ce5b4e4bc467f29102d2_JaffaCakes118.exe PID 4536 wrote to memory of 4500 4536 9b3250409072ce5b4e4bc467f29102d2_JaffaCakes118.exe 9b3250409072ce5b4e4bc467f29102d2_JaffaCakes118.exe PID 4500 wrote to memory of 4468 4500 9b3250409072ce5b4e4bc467f29102d2_JaffaCakes118.exe 9b3250409072ce5b4e4bc467f29102d2_jaffacakes118.exe PID 4500 wrote to memory of 4468 4500 9b3250409072ce5b4e4bc467f29102d2_JaffaCakes118.exe 9b3250409072ce5b4e4bc467f29102d2_jaffacakes118.exe PID 4500 wrote to memory of 4468 4500 9b3250409072ce5b4e4bc467f29102d2_JaffaCakes118.exe 9b3250409072ce5b4e4bc467f29102d2_jaffacakes118.exe PID 4500 wrote to memory of 228 4500 9b3250409072ce5b4e4bc467f29102d2_JaffaCakes118.exe cmd.exe PID 4500 wrote to memory of 228 4500 9b3250409072ce5b4e4bc467f29102d2_JaffaCakes118.exe cmd.exe PID 4500 wrote to memory of 228 4500 9b3250409072ce5b4e4bc467f29102d2_JaffaCakes118.exe cmd.exe PID 228 wrote to memory of 1732 228 cmd.exe PING.EXE PID 228 wrote to memory of 1732 228 cmd.exe PING.EXE PID 228 wrote to memory of 1732 228 cmd.exe PING.EXE PID 4468 wrote to memory of 3204 4468 9b3250409072ce5b4e4bc467f29102d2_jaffacakes118.exe 9b3250409072ce5b4e4bc467f29102d2_jaffacakes118.exe PID 4468 wrote to memory of 3204 4468 9b3250409072ce5b4e4bc467f29102d2_jaffacakes118.exe 9b3250409072ce5b4e4bc467f29102d2_jaffacakes118.exe PID 4468 wrote to memory of 3204 4468 9b3250409072ce5b4e4bc467f29102d2_jaffacakes118.exe 9b3250409072ce5b4e4bc467f29102d2_jaffacakes118.exe PID 4468 wrote to memory of 3204 4468 9b3250409072ce5b4e4bc467f29102d2_jaffacakes118.exe 9b3250409072ce5b4e4bc467f29102d2_jaffacakes118.exe PID 4468 wrote to memory of 3204 4468 9b3250409072ce5b4e4bc467f29102d2_jaffacakes118.exe 9b3250409072ce5b4e4bc467f29102d2_jaffacakes118.exe PID 4468 wrote to memory of 3204 4468 9b3250409072ce5b4e4bc467f29102d2_jaffacakes118.exe 9b3250409072ce5b4e4bc467f29102d2_jaffacakes118.exe PID 4468 wrote to memory of 3204 4468 9b3250409072ce5b4e4bc467f29102d2_jaffacakes118.exe 9b3250409072ce5b4e4bc467f29102d2_jaffacakes118.exe PID 4468 wrote to memory of 3204 4468 9b3250409072ce5b4e4bc467f29102d2_jaffacakes118.exe 9b3250409072ce5b4e4bc467f29102d2_jaffacakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9b3250409072ce5b4e4bc467f29102d2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\9b3250409072ce5b4e4bc467f29102d2_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9b3250409072ce5b4e4bc467f29102d2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\9b3250409072ce5b4e4bc467f29102d2_JaffaCakes118.exe"2⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9b3250409072ce5b4e4bc467f29102d2_jaffacakes118\9b3250409072ce5b4e4bc467f29102d2_jaffacakes118.exe"C:\Users\Admin\AppData\Local\Temp\9b3250409072ce5b4e4bc467f29102d2_jaffacakes118\9b3250409072ce5b4e4bc467f29102d2_jaffacakes118.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9b3250409072ce5b4e4bc467f29102d2_jaffacakes118\9b3250409072ce5b4e4bc467f29102d2_jaffacakes118.exe"C:\Users\Admin\AppData\Local\Temp\9b3250409072ce5b4e4bc467f29102d2_jaffacakes118\9b3250409072ce5b4e4bc467f29102d2_jaffacakes118.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 1000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\9b3250409072ce5b4e4bc467f29102d2_JaffaCakes118.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 10004⤵
- Runs ping.exe
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\9b3250409072ce5b4e4bc467f29102d2_JaffaCakes118.exe.logFilesize
706B
MD52ef5ef69dadb8865b3d5b58c956077b8
SHA1af2d869bac00685c745652bbd8b3fe82829a8998
SHA256363502eb2a4e53ba02d2d85412b901fcf8e06de221736bdffa949799ef3d21e3
SHA51266d4db5dd17d88e1d54ea0df3a7211a503dc4355de701259cefccc9f2e4e3ced9534b700099ffbb089a5a3acb082011c80b61801aa14aff76b379ce8f90d4fd3
-
C:\Users\Admin\AppData\Local\Temp\9b3250409072ce5b4e4bc467f29102d2_jaffacakes118\9b3250409072ce5b4e4bc467f29102d2_jaffacakes118.exeFilesize
612KB
MD59b3250409072ce5b4e4bc467f29102d2
SHA186a2fad69241a68a129c25531d5aea8ba2304bc3
SHA25624f089cd7b8348eea7f18b3d69fe7bd4d000f1a4c2ba7889a5e133e9862cc1e2
SHA512e7101b2f5d63410920d3b58e2c12ca00edba1351aa7d31cfa139af49f21f25fe328c0e446ee2885b046ca52083dfb012a6ea7555d86c098287dc1ff91d89b31f
-
C:\Users\Admin\AppData\Roaming\Imminent\Path.datFilesize
62B
MD5ff21416d8dfef8ed5bdb0167cba7ceb9
SHA1900b5fba86733095ff7beca58dc099236be7a17a
SHA2566e513b4c0e77cceeefea09f3e745868277a81fcba3f954e02f4004f0ba589aad
SHA5128946cc6d5581dfa692ee09a9c7d3e92d856db9daadc440ac03c14054d121a8be60ce9c29051baaadb4cc0d3630e2143ebb0f3ecf317d20a22624f07ce958683f
-
memory/3204-38-0x0000000005130000-0x000000000513A000-memory.dmpFilesize
40KB
-
memory/3204-37-0x0000000004F40000-0x0000000004F56000-memory.dmpFilesize
88KB
-
memory/4468-34-0x00000000750E0000-0x0000000075890000-memory.dmpFilesize
7.7MB
-
memory/4468-30-0x00000000750E0000-0x0000000075890000-memory.dmpFilesize
7.7MB
-
memory/4468-32-0x00000000750E0000-0x0000000075890000-memory.dmpFilesize
7.7MB
-
memory/4500-31-0x00000000750E0000-0x0000000075890000-memory.dmpFilesize
7.7MB
-
memory/4500-8-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/4500-11-0x00000000750E0000-0x0000000075890000-memory.dmpFilesize
7.7MB
-
memory/4500-12-0x00000000050A0000-0x00000000050B0000-memory.dmpFilesize
64KB
-
memory/4500-18-0x0000000007A10000-0x0000000007A28000-memory.dmpFilesize
96KB
-
memory/4500-14-0x00000000750E0000-0x0000000075890000-memory.dmpFilesize
7.7MB
-
memory/4500-15-0x00000000052E0000-0x000000000538E000-memory.dmpFilesize
696KB
-
memory/4500-16-0x0000000005180000-0x00000000051A8000-memory.dmpFilesize
160KB
-
memory/4500-17-0x0000000006D50000-0x0000000006DB6000-memory.dmpFilesize
408KB
-
memory/4536-6-0x00000000750E0000-0x0000000075890000-memory.dmpFilesize
7.7MB
-
memory/4536-13-0x00000000750E0000-0x0000000075890000-memory.dmpFilesize
7.7MB
-
memory/4536-7-0x0000000008060000-0x00000000080FC000-memory.dmpFilesize
624KB
-
memory/4536-0-0x00000000750EE000-0x00000000750EF000-memory.dmpFilesize
4KB
-
memory/4536-5-0x0000000004C40000-0x0000000004C5C000-memory.dmpFilesize
112KB
-
memory/4536-4-0x0000000004F70000-0x0000000004FDA000-memory.dmpFilesize
424KB
-
memory/4536-3-0x0000000004C90000-0x0000000004D22000-memory.dmpFilesize
584KB
-
memory/4536-2-0x0000000005150000-0x00000000056F4000-memory.dmpFilesize
5.6MB
-
memory/4536-1-0x0000000000360000-0x0000000000402000-memory.dmpFilesize
648KB