Analysis
-
max time kernel
131s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 08:32
Behavioral task
behavioral1
Sample
1a9d40f979c2e89ff475b9442dd032a0_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1a9d40f979c2e89ff475b9442dd032a0_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
1a9d40f979c2e89ff475b9442dd032a0_JaffaCakes118.exe
-
Size
96KB
-
MD5
1a9d40f979c2e89ff475b9442dd032a0
-
SHA1
cb2a3beadaa24b416bdec3e0772fa5d0f1885df3
-
SHA256
405dd042df3a215bef62d7d6c7f7a6fc1a215d882c64380f87a3ba436de24e62
-
SHA512
59612d4a31382f13cb72e326a9c692fa04fb445ce223172578f5eab077c2412366a8a62ef7f4fd3643f2999131c422beacca0a6700c82870b14ca9d9eb13f118
-
SSDEEP
1536:+nRDdoT5ByBtnGxYbee2lAVJkEtQwoAzkIvc0rqVq5GnE9unGg1cQ7IoqAqLWQu0:yc5kBtGxJneJERAw9E9cFmQ7INA4t/I0
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
1a9d40f979c2e89ff475b9442dd032a0_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation 1a9d40f979c2e89ff475b9442dd032a0_JaffaCakes118.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 1460 rundll32.exe -
Processes:
resource yara_rule behavioral2/memory/3920-1-0x0000000000400000-0x0000000000441000-memory.dmp vmprotect behavioral2/memory/3920-0-0x0000000000400000-0x0000000000441000-memory.dmp vmprotect behavioral2/memory/3920-12-0x0000000000400000-0x0000000000441000-memory.dmp vmprotect -
Drops file in System32 directory 1 IoCs
Processes:
1a9d40f979c2e89ff475b9442dd032a0_JaffaCakes118.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Darkbomb.dll 1a9d40f979c2e89ff475b9442dd032a0_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
1a9d40f979c2e89ff475b9442dd032a0_JaffaCakes118.execmd.exedescription pid process target process PID 3920 wrote to memory of 2152 3920 1a9d40f979c2e89ff475b9442dd032a0_JaffaCakes118.exe cmd.exe PID 3920 wrote to memory of 2152 3920 1a9d40f979c2e89ff475b9442dd032a0_JaffaCakes118.exe cmd.exe PID 3920 wrote to memory of 2152 3920 1a9d40f979c2e89ff475b9442dd032a0_JaffaCakes118.exe cmd.exe PID 2152 wrote to memory of 1460 2152 cmd.exe rundll32.exe PID 2152 wrote to memory of 1460 2152 cmd.exe rundll32.exe PID 2152 wrote to memory of 1460 2152 cmd.exe rundll32.exe PID 3920 wrote to memory of 4240 3920 1a9d40f979c2e89ff475b9442dd032a0_JaffaCakes118.exe cmd.exe PID 3920 wrote to memory of 4240 3920 1a9d40f979c2e89ff475b9442dd032a0_JaffaCakes118.exe cmd.exe PID 3920 wrote to memory of 4240 3920 1a9d40f979c2e89ff475b9442dd032a0_JaffaCakes118.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a9d40f979c2e89ff475b9442dd032a0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1a9d40f979c2e89ff475b9442dd032a0_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "c:\support338945a0.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe Darkbomb.dll FunctionStart3⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\1A9D40~1.EXE >> NUL2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\Darkbomb.dllFilesize
42KB
MD5cd7c4b4ea5da926d4b166b5a577c6b87
SHA178a18a4d1e628957221bbba7dc6a129cbffee719
SHA256f2b482023389f42578000a3bbefaa7df0e0dae11df82ab142a111c9ba556fa40
SHA5122ffd9ce2b1819c620bd90da87497b509114bbf8833d741ea609c4515144d2408282fd57807443b4ab47562c9721426ea3826a4e3991a182ee0777f4042433321
-
\??\c:\support338945a0.batFilesize
39B
MD5d6ad254c75599ac9ceb317d261cfe354
SHA1f9c9bae9bdba0ea9d3c486e13cb554ec9b010909
SHA2563142a7859b079df4a8fd3daf7a9d0057dd2c18ca302c69a6f9526ee543c9a655
SHA512b05820cab51f66b5b8213359f0a0ddde125e3eab5fdfd196393dc805fc02fd9e72bdb1704cc0718131fc55a8b3d7cd7e54f53fa8140a187b508c443f6d85b473
-
memory/1460-10-0x0000000010000000-0x0000000010012000-memory.dmpFilesize
72KB
-
memory/1460-11-0x0000000000DE0000-0x0000000000DE5000-memory.dmpFilesize
20KB
-
memory/1460-13-0x0000000000DE0000-0x0000000000DE5000-memory.dmpFilesize
20KB
-
memory/3920-1-0x0000000000400000-0x0000000000441000-memory.dmpFilesize
260KB
-
memory/3920-0-0x0000000000400000-0x0000000000441000-memory.dmpFilesize
260KB
-
memory/3920-12-0x0000000000400000-0x0000000000441000-memory.dmpFilesize
260KB