Analysis
-
max time kernel
147s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
02-07-2024 11:25
Behavioral task
behavioral1
Sample
1f26e5f9b44c28b37b6cd13283838366_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
1f26e5f9b44c28b37b6cd13283838366_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
1f26e5f9b44c28b37b6cd13283838366_JaffaCakes118.exe
-
Size
416KB
-
MD5
1f26e5f9b44c28b37b6cd13283838366
-
SHA1
272b94c4d1d30dc9478675dd3df4a38029c1113e
-
SHA256
1225de9af9f6b29985e9304fa1056b8c7da036215a5e054c0ff6d7129c91a59f
-
SHA512
3d3d10eb33006de70ffa36a5999b9d6ac2eafdff0a27c313542b34cffdbb8b736b5573ce21bd9778ddd0a825c7a807c64e15bd9d284fa80b316464505267936c
-
SSDEEP
6144:N4IB2aqIOEzOFtXs0ncp2sRAztOf7Yp4jOa9UpU:TBQIsFtXlc4w
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
1f26e5f9b44c28b37b6cd13283838366_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation 1f26e5f9b44c28b37b6cd13283838366_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
Processes:
temp.exepid process 3204 temp.exe -
Drops file in System32 directory 4 IoCs
Processes:
sysprep.exedescription ioc process File opened for modification C:\Windows\system32\sysprep\Panther\diagwrn.xml sysprep.exe File opened for modification C:\Windows\system32\sysprep\Panther\setupact.log sysprep.exe File opened for modification C:\Windows\system32\sysprep\Panther\setuperr.log sysprep.exe File opened for modification C:\Windows\system32\sysprep\Panther\diagerr.xml sysprep.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
Processes:
1f26e5f9b44c28b37b6cd13283838366_JaffaCakes118.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 1f26e5f9b44c28b37b6cd13283838366_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
temp.exepid process 3204 temp.exe 3204 temp.exe -
Suspicious use of AdjustPrivilegeToken 16 IoCs
Processes:
Explorer.EXEdescription pid process Token: SeShutdownPrivilege 3468 Explorer.EXE Token: SeCreatePagefilePrivilege 3468 Explorer.EXE Token: SeShutdownPrivilege 3468 Explorer.EXE Token: SeCreatePagefilePrivilege 3468 Explorer.EXE Token: SeShutdownPrivilege 3468 Explorer.EXE Token: SeCreatePagefilePrivilege 3468 Explorer.EXE Token: SeShutdownPrivilege 3468 Explorer.EXE Token: SeCreatePagefilePrivilege 3468 Explorer.EXE Token: SeShutdownPrivilege 3468 Explorer.EXE Token: SeCreatePagefilePrivilege 3468 Explorer.EXE Token: SeShutdownPrivilege 3468 Explorer.EXE Token: SeCreatePagefilePrivilege 3468 Explorer.EXE Token: SeShutdownPrivilege 3468 Explorer.EXE Token: SeCreatePagefilePrivilege 3468 Explorer.EXE Token: SeShutdownPrivilege 3468 Explorer.EXE Token: SeCreatePagefilePrivilege 3468 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 3468 Explorer.EXE 3468 Explorer.EXE -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
1f26e5f9b44c28b37b6cd13283838366_JaffaCakes118.exetemp.exeExplorer.EXEdescription pid process target process PID 3332 wrote to memory of 3204 3332 1f26e5f9b44c28b37b6cd13283838366_JaffaCakes118.exe temp.exe PID 3332 wrote to memory of 3204 3332 1f26e5f9b44c28b37b6cd13283838366_JaffaCakes118.exe temp.exe PID 3204 wrote to memory of 3468 3204 temp.exe Explorer.EXE PID 3204 wrote to memory of 3468 3204 temp.exe Explorer.EXE PID 3204 wrote to memory of 3468 3204 temp.exe Explorer.EXE PID 3204 wrote to memory of 3468 3204 temp.exe Explorer.EXE PID 3204 wrote to memory of 3468 3204 temp.exe Explorer.EXE PID 3204 wrote to memory of 3468 3204 temp.exe Explorer.EXE PID 3204 wrote to memory of 3468 3204 temp.exe Explorer.EXE PID 3204 wrote to memory of 3468 3204 temp.exe Explorer.EXE PID 3204 wrote to memory of 3468 3204 temp.exe Explorer.EXE PID 3204 wrote to memory of 3468 3204 temp.exe Explorer.EXE PID 3204 wrote to memory of 3468 3204 temp.exe Explorer.EXE PID 3204 wrote to memory of 3468 3204 temp.exe Explorer.EXE PID 3204 wrote to memory of 3468 3204 temp.exe Explorer.EXE PID 3204 wrote to memory of 3468 3204 temp.exe Explorer.EXE PID 3204 wrote to memory of 3468 3204 temp.exe Explorer.EXE PID 3204 wrote to memory of 3468 3204 temp.exe Explorer.EXE PID 3204 wrote to memory of 3468 3204 temp.exe Explorer.EXE PID 3204 wrote to memory of 3468 3204 temp.exe Explorer.EXE PID 3204 wrote to memory of 3468 3204 temp.exe Explorer.EXE PID 3204 wrote to memory of 3468 3204 temp.exe Explorer.EXE PID 3468 wrote to memory of 4036 3468 Explorer.EXE sysprep.exe PID 3468 wrote to memory of 4036 3468 Explorer.EXE sysprep.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1f26e5f9b44c28b37b6cd13283838366_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1f26e5f9b44c28b37b6cd13283838366_JaffaCakes118.exe"2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\temp.exe"C:\Users\Admin\AppData\Local\Temp\temp.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sysprep\sysprep.exe"C:\Windows\system32\sysprep\sysprep.exe" "C:\Users\Admin\AppData\Local\Temp\net.exe" "C:\Windows\system32" ""2⤵
- Drops file in System32 directory
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\temp.exeFilesize
86KB
MD5425609a2c35081730982a01d72a76cbe
SHA164f95fe985a7ef7ee4f396e36279aa31498ac3cc
SHA256e03145fefe7fef82c2a476d7dec03305d7da79cd3c8fe1578177580175febbd3
SHA5126ede1415ac51d588a71bfb5697a599eb777e9530240b7a3524626d2a230bb51017c9b3d05923c5cb41800cca9818f2d99484310390a0425ef8e48984c4c9cfd4
-
memory/3468-62-0x0000000002CB0000-0x0000000002CB1000-memory.dmpFilesize
4KB
-
memory/3468-61-0x0000000002AE0000-0x0000000002AE1000-memory.dmpFilesize
4KB