Analysis
-
max time kernel
133s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
28-06-2024 01:07
Static task
static1
Behavioral task
behavioral1
Sample
183a8b19a056c944237876bea31a697c_JaffaCakes118.exe
Resource
win7-20240508-en
General
-
Target
183a8b19a056c944237876bea31a697c_JaffaCakes118.exe
-
Size
942KB
-
MD5
183a8b19a056c944237876bea31a697c
-
SHA1
c11f5484af3e4d8e34c35a7b7363078b0f23e079
-
SHA256
d153e8b542963a9c9ae3fa96421f2ec2c5779759d0a086f3545b7e9c91074476
-
SHA512
29821c783a90ffbeca765cb50e178fa772acc78b22b23490e7329b8b406cd6184e65359a24c068b3ac30936410b1a7920ed393b08ee2bb9e34fd81604eed89b6
-
SSDEEP
12288:GO4jeQ5jsruJH+ReJqvqfLRXwK4+HNONnvsyl9vai2K046Mnq0UnsO5lJkKzUvoc:XHBQLW10ergut8+VuRHPXWMj
Malware Config
Extracted
formbook
4.1
rf3t
palmettohomeswakulla.com
sorelleapparel.com
abouttohour.com
ogrownhemp.com
themontagnard.com
zarioch.space
lty712.info
ajdstone.com
600plusgymspa.com
schmitzland.com
luhuigw.com
mysafeplacetoinsure.com
barkpark.club
investigation-science.com
sermonartnotes.net
gorgeousflippinllc.com
smarttrendshop.com
markusjungfoto.com
glyzaelbol.info
thewiseowl.art
ladycigarclub.com
compasschick.com
xrk72.xyz
mynextversion.com
stresimer.com
bugitee.com
tofigaming.com
themokyoco.com
rickysinmiami.com
terashun-shop.com
istanbulartroskopi.xyz
sleekrevenge.com
linqlax.com
scenic-usa.com
catnapupuncture.com
ioqoqoquyi.xyz
romantictravels.love
skillfulscooptoseetoday.info
eatonmilano.com
fhaonlinehomes.com
jumpmine.com
economybevmachinery.com
stereodeluxemusic.com
652ch.com
ecnomi.com
eastvalleyloanofficer.com
naytor.online
mpteaminc.com
ghalerodkhan.com
rentalpixels.com
jerrysmunchies.com
jackohoeg.com
haroldbrandon.com
sipsongpanna.biz
gooddeats.com
dtdfamily.com
metaphilestudios.net
bgari.com
sarsukeiw.xyz
brunsbouw.net
myfilthy.com
mcnallynd.xyz
corridapromocao.com
nishiawakura-rain.info
logjed063.xyz
Signatures
-
Formbook payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4192-17-0x0000000000400000-0x000000000042F000-memory.dmp formbook -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
183a8b19a056c944237876bea31a697c_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation 183a8b19a056c944237876bea31a697c_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
183a8b19a056c944237876bea31a697c_JaffaCakes118.exedescription pid process target process PID 3900 set thread context of 4192 3900 183a8b19a056c944237876bea31a697c_JaffaCakes118.exe 183a8b19a056c944237876bea31a697c_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
183a8b19a056c944237876bea31a697c_JaffaCakes118.exe183a8b19a056c944237876bea31a697c_JaffaCakes118.exepid process 3900 183a8b19a056c944237876bea31a697c_JaffaCakes118.exe 4192 183a8b19a056c944237876bea31a697c_JaffaCakes118.exe 4192 183a8b19a056c944237876bea31a697c_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
183a8b19a056c944237876bea31a697c_JaffaCakes118.exedescription pid process Token: SeDebugPrivilege 3900 183a8b19a056c944237876bea31a697c_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
183a8b19a056c944237876bea31a697c_JaffaCakes118.exedescription pid process target process PID 3900 wrote to memory of 4008 3900 183a8b19a056c944237876bea31a697c_JaffaCakes118.exe schtasks.exe PID 3900 wrote to memory of 4008 3900 183a8b19a056c944237876bea31a697c_JaffaCakes118.exe schtasks.exe PID 3900 wrote to memory of 4008 3900 183a8b19a056c944237876bea31a697c_JaffaCakes118.exe schtasks.exe PID 3900 wrote to memory of 4192 3900 183a8b19a056c944237876bea31a697c_JaffaCakes118.exe 183a8b19a056c944237876bea31a697c_JaffaCakes118.exe PID 3900 wrote to memory of 4192 3900 183a8b19a056c944237876bea31a697c_JaffaCakes118.exe 183a8b19a056c944237876bea31a697c_JaffaCakes118.exe PID 3900 wrote to memory of 4192 3900 183a8b19a056c944237876bea31a697c_JaffaCakes118.exe 183a8b19a056c944237876bea31a697c_JaffaCakes118.exe PID 3900 wrote to memory of 4192 3900 183a8b19a056c944237876bea31a697c_JaffaCakes118.exe 183a8b19a056c944237876bea31a697c_JaffaCakes118.exe PID 3900 wrote to memory of 4192 3900 183a8b19a056c944237876bea31a697c_JaffaCakes118.exe 183a8b19a056c944237876bea31a697c_JaffaCakes118.exe PID 3900 wrote to memory of 4192 3900 183a8b19a056c944237876bea31a697c_JaffaCakes118.exe 183a8b19a056c944237876bea31a697c_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\183a8b19a056c944237876bea31a697c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\183a8b19a056c944237876bea31a697c_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VKyccEisJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAA98.tmp"2⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Users\Admin\AppData\Local\Temp\183a8b19a056c944237876bea31a697c_JaffaCakes118.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpAA98.tmpFilesize
1KB
MD57e2a1618f26e2968b56e999d5a011ca5
SHA16af136cf5c6c7d5685a20180b4a1db32f62cf43a
SHA256510cc1ffaf7a05f3ccd9777b4fc2d5c9ad6ef234db8b549258a22caf340c49ae
SHA51273adc61c0ed4c445986e07c7df34c154cf593ecc63c28a8b3150761d7920131d14af3b5becebe7d63b8a8eb7ab9d4e10f8421cd4a38d883a0b8bd12f264a0de8
-
memory/3900-8-0x0000000004BE0000-0x0000000004C02000-memory.dmpFilesize
136KB
-
memory/3900-5-0x0000000004A60000-0x0000000004A6A000-memory.dmpFilesize
40KB
-
memory/3900-9-0x0000000004400000-0x0000000004414000-memory.dmpFilesize
80KB
-
memory/3900-4-0x0000000004AE0000-0x0000000004B72000-memory.dmpFilesize
584KB
-
memory/3900-10-0x000000007496E000-0x000000007496F000-memory.dmpFilesize
4KB
-
memory/3900-6-0x0000000004B80000-0x0000000004BD6000-memory.dmpFilesize
344KB
-
memory/3900-7-0x0000000074960000-0x0000000075110000-memory.dmpFilesize
7.7MB
-
memory/3900-11-0x0000000074960000-0x0000000075110000-memory.dmpFilesize
7.7MB
-
memory/3900-3-0x0000000004FF0000-0x0000000005594000-memory.dmpFilesize
5.6MB
-
memory/3900-2-0x00000000049A0000-0x0000000004A3C000-memory.dmpFilesize
624KB
-
memory/3900-0-0x000000007496E000-0x000000007496F000-memory.dmpFilesize
4KB
-
memory/3900-12-0x0000000006210000-0x00000000062B4000-memory.dmpFilesize
656KB
-
memory/3900-13-0x0000000005DA0000-0x0000000005DF6000-memory.dmpFilesize
344KB
-
memory/3900-1-0x0000000000050000-0x0000000000142000-memory.dmpFilesize
968KB
-
memory/3900-19-0x0000000074960000-0x0000000075110000-memory.dmpFilesize
7.7MB
-
memory/4192-17-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4192-20-0x0000000001050000-0x000000000139A000-memory.dmpFilesize
3.3MB