Analysis
-
max time kernel
147s -
max time network
55s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
28-06-2024 09:33
Behavioral task
behavioral1
Sample
19a4255837768deb829292292e02ab98_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
19a4255837768deb829292292e02ab98_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
19a4255837768deb829292292e02ab98_JaffaCakes118.exe
-
Size
214KB
-
MD5
19a4255837768deb829292292e02ab98
-
SHA1
0a460aa0774f3d508856b7936f793051c14cecf5
-
SHA256
0e631e8ab2131938486c4ae8e2880790ea0f232cf837dd90c5507500986cb16b
-
SHA512
293a8065991cf27c1387351412ef01e59e3e9fbed87f3564a1172e04db006c429aad3f0e40249f1920a9a4414ffe2166932c0cd364c4734451b996251180ffe8
-
SSDEEP
3072:2ttEE8okQqIKA0cP/fAndU+hs7Uw4zt3dj9Q2eYCtNONVrb0mHl2fbvCJ7s7qn:gE9otjnD+ZwQfGfEb0k2jv
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
19a4255837768deb829292292e02ab98_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation 19a4255837768deb829292292e02ab98_JaffaCakes118.exe -
Drops startup file 1 IoCs
Processes:
vbc.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\A-634656738.exe vbc.exe -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
19a4255837768deb829292292e02ab98_JaffaCakes118.exedescription pid process target process PID 1872 set thread context of 3620 1872 19a4255837768deb829292292e02ab98_JaffaCakes118.exe vbc.exe -
Drops file in Windows directory 1 IoCs
Processes:
vbc.exedescription ioc process File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe vbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
Processes:
19a4255837768deb829292292e02ab98_JaffaCakes118.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings 19a4255837768deb829292292e02ab98_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
19a4255837768deb829292292e02ab98_JaffaCakes118.exevbc.execmd.exedescription pid process target process PID 1872 wrote to memory of 3620 1872 19a4255837768deb829292292e02ab98_JaffaCakes118.exe vbc.exe PID 1872 wrote to memory of 3620 1872 19a4255837768deb829292292e02ab98_JaffaCakes118.exe vbc.exe PID 1872 wrote to memory of 3620 1872 19a4255837768deb829292292e02ab98_JaffaCakes118.exe vbc.exe PID 1872 wrote to memory of 3620 1872 19a4255837768deb829292292e02ab98_JaffaCakes118.exe vbc.exe PID 1872 wrote to memory of 3620 1872 19a4255837768deb829292292e02ab98_JaffaCakes118.exe vbc.exe PID 1872 wrote to memory of 3620 1872 19a4255837768deb829292292e02ab98_JaffaCakes118.exe vbc.exe PID 1872 wrote to memory of 3620 1872 19a4255837768deb829292292e02ab98_JaffaCakes118.exe vbc.exe PID 1872 wrote to memory of 3620 1872 19a4255837768deb829292292e02ab98_JaffaCakes118.exe vbc.exe PID 1872 wrote to memory of 3620 1872 19a4255837768deb829292292e02ab98_JaffaCakes118.exe vbc.exe PID 1872 wrote to memory of 3620 1872 19a4255837768deb829292292e02ab98_JaffaCakes118.exe vbc.exe PID 1872 wrote to memory of 3620 1872 19a4255837768deb829292292e02ab98_JaffaCakes118.exe vbc.exe PID 1872 wrote to memory of 3620 1872 19a4255837768deb829292292e02ab98_JaffaCakes118.exe vbc.exe PID 1872 wrote to memory of 3620 1872 19a4255837768deb829292292e02ab98_JaffaCakes118.exe vbc.exe PID 1872 wrote to memory of 3620 1872 19a4255837768deb829292292e02ab98_JaffaCakes118.exe vbc.exe PID 1872 wrote to memory of 3620 1872 19a4255837768deb829292292e02ab98_JaffaCakes118.exe vbc.exe PID 1872 wrote to memory of 3620 1872 19a4255837768deb829292292e02ab98_JaffaCakes118.exe vbc.exe PID 1872 wrote to memory of 3620 1872 19a4255837768deb829292292e02ab98_JaffaCakes118.exe vbc.exe PID 1872 wrote to memory of 3620 1872 19a4255837768deb829292292e02ab98_JaffaCakes118.exe vbc.exe PID 1872 wrote to memory of 3620 1872 19a4255837768deb829292292e02ab98_JaffaCakes118.exe vbc.exe PID 1872 wrote to memory of 2792 1872 19a4255837768deb829292292e02ab98_JaffaCakes118.exe WScript.exe PID 1872 wrote to memory of 2792 1872 19a4255837768deb829292292e02ab98_JaffaCakes118.exe WScript.exe PID 1872 wrote to memory of 2792 1872 19a4255837768deb829292292e02ab98_JaffaCakes118.exe WScript.exe PID 3620 wrote to memory of 660 3620 vbc.exe cmd.exe PID 3620 wrote to memory of 660 3620 vbc.exe cmd.exe PID 3620 wrote to memory of 660 3620 vbc.exe cmd.exe PID 660 wrote to memory of 1308 660 cmd.exe schtasks.exe PID 660 wrote to memory of 1308 660 cmd.exe schtasks.exe PID 660 wrote to memory of 1308 660 cmd.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\19a4255837768deb829292292e02ab98_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\19a4255837768deb829292292e02ab98_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe2⤵
- Drops startup file
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Windows\Temp\temp-634656738.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /DELETE /TN "A-634656738"4⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\SRjmh.vbs"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\SRjmh.vbsFilesize
395B
MD5c2dbfee9cea633d9822b8d9b4b32d162
SHA1fedb9241fb8b7148aa01fcd52dce439a1bd1856b
SHA2569b018713178c4314af64aea67c02f93f301b17cdbf2bbca616ddb58605be4c08
SHA512cd1e040f0b87d6ae774581ab3c9acc3162fd48f28cb50812a1a9ee2d0dfcf7b164167cbc5eacb4b5a093dd89fb65c80956f98efa9df72a9da1678442ec653c6e
-
C:\Windows\Temp\temp-634656738.batFilesize
317B
MD534025b5482d696957cf1195dce70c813
SHA1a270001f8b107796ae6796284b48d3586e30b3e1
SHA256e7b156a7e85c3625bb2f6919aacd62160fa796bb151d31accd6f1b2e78924acc
SHA512735dd4e731458dbcfc4c9418ee91e3be729d796780ff5405762cab3d368bfcd156cf91cd3fb59172559823c322386a733d08bdcd23664439f84fa2254e9f66cf
-
memory/1872-0-0x0000000075292000-0x0000000075293000-memory.dmpFilesize
4KB
-
memory/1872-1-0x0000000075290000-0x0000000075841000-memory.dmpFilesize
5.7MB
-
memory/1872-2-0x0000000075290000-0x0000000075841000-memory.dmpFilesize
5.7MB
-
memory/1872-23-0x0000000075290000-0x0000000075841000-memory.dmpFilesize
5.7MB
-
memory/3620-3-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/3620-6-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/3620-7-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/3620-11-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/3620-17-0x0000000000430000-0x00000000004F9000-memory.dmpFilesize
804KB