Analysis
-
max time kernel
90s -
max time network
85s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
02-07-2024 06:37
Static task
static1
Behavioral task
behavioral1
Sample
1e54f5f969cc19fde67ba03e92694105_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
1e54f5f969cc19fde67ba03e92694105_JaffaCakes118.exe
-
Size
111KB
-
MD5
1e54f5f969cc19fde67ba03e92694105
-
SHA1
2a3840d9cfa01738846247b51c38e40dd67adf3d
-
SHA256
09020a8d64e1bfa4e061c63c3250fc4cd563e96a625e0d2a6cf0f1a658c33547
-
SHA512
233e1b7bb3cc10cc8bc309640b135dec28754c5f5dade0c2219422d3de128be054b38c5c50c68211c6de9030584cbbeef99af6fbe8b1a31c2ce228732134faff
-
SSDEEP
3072:7kYvLxQxIa+DvY+1j2qOix4J2vNbGfvGnd3gW5ZM4/uci4+D:7Hx0AQ+40NdndPZMTch
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
1e54f5f969cc19fde67ba03e92694105_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 1e54f5f969cc19fde67ba03e92694105_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
Processes:
rjcjfapncnukfcjf.exepid process 3180 rjcjfapncnukfcjf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4400 940 WerFault.exe svchost.exe 3344 3612 WerFault.exe svchost.exe -
Processes:
IEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426064115" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{8D22CC6E-383D-11EF-BCA5-D6AA8B0874BD} = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 648 -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
1e54f5f969cc19fde67ba03e92694105_JaffaCakes118.exerjcjfapncnukfcjf.exedescription pid process Token: SeSecurityPrivilege 2768 1e54f5f969cc19fde67ba03e92694105_JaffaCakes118.exe Token: SeDebugPrivilege 2768 1e54f5f969cc19fde67ba03e92694105_JaffaCakes118.exe Token: SeSecurityPrivilege 3180 rjcjfapncnukfcjf.exe Token: SeLoadDriverPrivilege 3180 rjcjfapncnukfcjf.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
IEXPLORE.EXEpid process 2900 IEXPLORE.EXE 2900 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
IEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEpid process 2900 IEXPLORE.EXE 2900 IEXPLORE.EXE 4500 IEXPLORE.EXE 4500 IEXPLORE.EXE 4500 IEXPLORE.EXE 4500 IEXPLORE.EXE 2900 IEXPLORE.EXE 2900 IEXPLORE.EXE 3236 IEXPLORE.EXE 3236 IEXPLORE.EXE 3236 IEXPLORE.EXE 3236 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 37 IoCs
Processes:
1e54f5f969cc19fde67ba03e92694105_JaffaCakes118.exeiexplore.exeIEXPLORE.EXEiexplore.exedescription pid process target process PID 2768 wrote to memory of 940 2768 1e54f5f969cc19fde67ba03e92694105_JaffaCakes118.exe svchost.exe PID 2768 wrote to memory of 940 2768 1e54f5f969cc19fde67ba03e92694105_JaffaCakes118.exe svchost.exe PID 2768 wrote to memory of 940 2768 1e54f5f969cc19fde67ba03e92694105_JaffaCakes118.exe svchost.exe PID 2768 wrote to memory of 940 2768 1e54f5f969cc19fde67ba03e92694105_JaffaCakes118.exe svchost.exe PID 2768 wrote to memory of 940 2768 1e54f5f969cc19fde67ba03e92694105_JaffaCakes118.exe svchost.exe PID 2768 wrote to memory of 940 2768 1e54f5f969cc19fde67ba03e92694105_JaffaCakes118.exe svchost.exe PID 2768 wrote to memory of 940 2768 1e54f5f969cc19fde67ba03e92694105_JaffaCakes118.exe svchost.exe PID 2768 wrote to memory of 940 2768 1e54f5f969cc19fde67ba03e92694105_JaffaCakes118.exe svchost.exe PID 2768 wrote to memory of 940 2768 1e54f5f969cc19fde67ba03e92694105_JaffaCakes118.exe svchost.exe PID 2768 wrote to memory of 2128 2768 1e54f5f969cc19fde67ba03e92694105_JaffaCakes118.exe iexplore.exe PID 2768 wrote to memory of 2128 2768 1e54f5f969cc19fde67ba03e92694105_JaffaCakes118.exe iexplore.exe PID 2768 wrote to memory of 2128 2768 1e54f5f969cc19fde67ba03e92694105_JaffaCakes118.exe iexplore.exe PID 2128 wrote to memory of 2900 2128 iexplore.exe IEXPLORE.EXE PID 2128 wrote to memory of 2900 2128 iexplore.exe IEXPLORE.EXE PID 2900 wrote to memory of 4500 2900 IEXPLORE.EXE IEXPLORE.EXE PID 2900 wrote to memory of 4500 2900 IEXPLORE.EXE IEXPLORE.EXE PID 2900 wrote to memory of 4500 2900 IEXPLORE.EXE IEXPLORE.EXE PID 2768 wrote to memory of 3612 2768 1e54f5f969cc19fde67ba03e92694105_JaffaCakes118.exe svchost.exe PID 2768 wrote to memory of 3612 2768 1e54f5f969cc19fde67ba03e92694105_JaffaCakes118.exe svchost.exe PID 2768 wrote to memory of 3612 2768 1e54f5f969cc19fde67ba03e92694105_JaffaCakes118.exe svchost.exe PID 2768 wrote to memory of 3612 2768 1e54f5f969cc19fde67ba03e92694105_JaffaCakes118.exe svchost.exe PID 2768 wrote to memory of 3612 2768 1e54f5f969cc19fde67ba03e92694105_JaffaCakes118.exe svchost.exe PID 2768 wrote to memory of 3612 2768 1e54f5f969cc19fde67ba03e92694105_JaffaCakes118.exe svchost.exe PID 2768 wrote to memory of 3612 2768 1e54f5f969cc19fde67ba03e92694105_JaffaCakes118.exe svchost.exe PID 2768 wrote to memory of 3612 2768 1e54f5f969cc19fde67ba03e92694105_JaffaCakes118.exe svchost.exe PID 2768 wrote to memory of 3612 2768 1e54f5f969cc19fde67ba03e92694105_JaffaCakes118.exe svchost.exe PID 2768 wrote to memory of 3152 2768 1e54f5f969cc19fde67ba03e92694105_JaffaCakes118.exe iexplore.exe PID 2768 wrote to memory of 3152 2768 1e54f5f969cc19fde67ba03e92694105_JaffaCakes118.exe iexplore.exe PID 2768 wrote to memory of 3152 2768 1e54f5f969cc19fde67ba03e92694105_JaffaCakes118.exe iexplore.exe PID 3152 wrote to memory of 1124 3152 iexplore.exe IEXPLORE.EXE PID 3152 wrote to memory of 1124 3152 iexplore.exe IEXPLORE.EXE PID 2900 wrote to memory of 3236 2900 IEXPLORE.EXE IEXPLORE.EXE PID 2900 wrote to memory of 3236 2900 IEXPLORE.EXE IEXPLORE.EXE PID 2900 wrote to memory of 3236 2900 IEXPLORE.EXE IEXPLORE.EXE PID 2768 wrote to memory of 3180 2768 1e54f5f969cc19fde67ba03e92694105_JaffaCakes118.exe rjcjfapncnukfcjf.exe PID 2768 wrote to memory of 3180 2768 1e54f5f969cc19fde67ba03e92694105_JaffaCakes118.exe rjcjfapncnukfcjf.exe PID 2768 wrote to memory of 3180 2768 1e54f5f969cc19fde67ba03e92694105_JaffaCakes118.exe rjcjfapncnukfcjf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1e54f5f969cc19fde67ba03e92694105_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1e54f5f969cc19fde67ba03e92694105_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 940 -s 2043⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2900 CREDAT:17410 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2900 CREDAT:17416 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3612 -s 2083⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"3⤵
- Modifies Internet Explorer settings
-
C:\Users\Admin\AppData\Local\Temp\rjcjfapncnukfcjf.exe"C:\Users\Admin\AppData\Local\Temp\rjcjfapncnukfcjf.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 940 -ip 9401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3612 -ip 36121⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\rjcjfapncnukfcjf.exeFilesize
111KB
MD51e54f5f969cc19fde67ba03e92694105
SHA12a3840d9cfa01738846247b51c38e40dd67adf3d
SHA25609020a8d64e1bfa4e061c63c3250fc4cd563e96a625e0d2a6cf0f1a658c33547
SHA512233e1b7bb3cc10cc8bc309640b135dec28754c5f5dade0c2219422d3de128be054b38c5c50c68211c6de9030584cbbeef99af6fbe8b1a31c2ce228732134faff
-
memory/940-10-0x0000000000930000-0x0000000000931000-memory.dmpFilesize
4KB
-
memory/940-9-0x0000000000950000-0x0000000000951000-memory.dmpFilesize
4KB
-
memory/2768-1-0x0000000000400000-0x0000000000437C84-memory.dmpFilesize
223KB
-
memory/2768-14-0x0000000000400000-0x0000000000437C84-memory.dmpFilesize
223KB
-
memory/2768-6-0x0000000001F20000-0x0000000001F21000-memory.dmpFilesize
4KB
-
memory/2768-7-0x0000000000400000-0x0000000000437C84-memory.dmpFilesize
223KB
-
memory/2768-2-0x000000000042A000-0x0000000000438000-memory.dmpFilesize
56KB
-
memory/2768-3-0x0000000000400000-0x0000000000437C84-memory.dmpFilesize
223KB
-
memory/2768-11-0x0000000000400000-0x0000000000437C84-memory.dmpFilesize
223KB
-
memory/2768-0-0x000000000042A000-0x0000000000438000-memory.dmpFilesize
56KB
-
memory/2768-15-0x0000000077562000-0x0000000077563000-memory.dmpFilesize
4KB
-
memory/2768-17-0x0000000000400000-0x0000000000437C84-memory.dmpFilesize
223KB
-
memory/2768-18-0x0000000077562000-0x0000000077563000-memory.dmpFilesize
4KB
-
memory/2768-4-0x0000000000400000-0x0000000000437C84-memory.dmpFilesize
223KB
-
memory/3180-27-0x0000000000400000-0x0000000000437C84-memory.dmpFilesize
223KB
-
memory/3180-31-0x0000000000400000-0x0000000000437C84-memory.dmpFilesize
223KB
-
memory/3180-30-0x000000000042A000-0x0000000000438000-memory.dmpFilesize
56KB
-
memory/3180-34-0x0000000000400000-0x0000000000437C84-memory.dmpFilesize
223KB