Analysis
-
max time kernel
141s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
26-07-2024 00:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
71d731c54be425abff3ff46d8ecc2f45_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
71d731c54be425abff3ff46d8ecc2f45_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
71d731c54be425abff3ff46d8ecc2f45_JaffaCakes118.exe
-
Size
46KB
-
MD5
71d731c54be425abff3ff46d8ecc2f45
-
SHA1
4979018a4cb386b90561ea2c4f6f32575e91548a
-
SHA256
64a8fd864c78836904744aad425c4c0e7bb988078560b0c35cffaf7442b434b2
-
SHA512
f6d761f62a77910929648c132fbb1b5f4098e01b79e3cfd8e3614d4e015a9f50c086cb46130ef9555f53b3b8ad3b006268b00f60cc16d7c0214602ae8a1c3363
-
SSDEEP
768:usmVLSlH33MzQe8YhHM3EYx1OCqOLUc7T/paAqHvmmkACN8mq41Qq0J:YM0QeJMDx133AAqHvmmkHZ1QqE
Score
10/10
Malware Config
Signatures
-
Modifies firewall policy service 3 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List 71d731c54be425abff3ff46d8ecc2f45_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\71d731c54be425abff3ff46d8ecc2f45_JaffaCakes118.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\71d731c54be425abff3ff46d8ecc2f45_JaffaCakes118.exe:*:Enabled:Windows" 71d731c54be425abff3ff46d8ecc2f45_JaffaCakes118.exe -
Executes dropped EXE 2 IoCs
pid Process 2624 svchost.exe 2776 svchost.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows = "svchost.exe" 71d731c54be425abff3ff46d8ecc2f45_JaffaCakes118.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2760 set thread context of 2880 2760 71d731c54be425abff3ff46d8ecc2f45_JaffaCakes118.exe 30 PID 2624 set thread context of 2776 2624 svchost.exe 32 -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\limewire pro\shared\Avast AntiVirus Professional Crack.exe svchost.exe File created C:\Program Files (x86)\tesla\files\MSN Spammer\Nudger.exe svchost.exe File created C:\Program Files (x86)\winmx\shared\Microsoft Visual Basic KeyGen.exe svchost.exe File created C:\Program Files (x86)\kazaa lite\my shared folder\Sony Vegas 9 Keygen.exe svchost.exe File created C:\Program Files (x86)\icq\shared folder\Microsoft Visual C++ KeyGen.exe svchost.exe File created C:\Program Files (x86)\kazaa lite k++\my shared folder\SAMP GTA MultiPlayer.exe svchost.exe File created C:\Program Files (x86)\icq\shared folder\Counter Strike Source Keygen.exe svchost.exe File created C:\Program Files (x86)\icq\shared folder\MSN Password Cracker.exe svchost.exe File created C:\Program Files (x86)\grokster\my grokster\Steam Crack.exe svchost.exe File created C:\Program Files (x86)\grokster\my grokster\Nero 9.x Keygen.exe svchost.exe File created C:\Program Files (x86)\limewire pro\shared\Young girl nude.scr svchost.exe File created C:\Program Files (x86)\kazaa lite\my shared folder\Avast AntiVirus Professional Crack.exe svchost.exe File created C:\Program Files (x86)\kazaa lite k++\my shared folder\Sony Vegas 9 Keygen.exe svchost.exe File created C:\Program Files (x86)\winmx\shared\Microsoft Visual Studio KeyGen.exe svchost.exe File created C:\Program Files (x86)\limewire pro\shared\SAMP GTA MultiPlayer.exe svchost.exe File created C:\Program Files (x86)\limewire pro\shared\Bebo\Myspace\Facebook Password Stealer.exe svchost.exe File created C:\Program Files (x86)\edonkey2000\incoming\Counter Strike Source Keygen.exe svchost.exe File created C:\Program Files (x86)\emule\incoming\Windows XP Validator Crack.exe svchost.exe File created C:\Program Files (x86)\limewire\shared\Kaspersky Antivirus 2009 Crack.exe svchost.exe File created C:\Program Files (x86)\tesla\files\Steam Crack.exe svchost.exe File created C:\Program Files (x86)\tesla\files\Youtube Account Cracker.exe svchost.exe File created C:\Program Files (x86)\kazaa\my shared folder\Keylogger.exe svchost.exe File created C:\Program Files (x86)\bearshare\shared\Nero 8 Keygen.exe svchost.exe File created C:\Program Files (x86)\bearshare pro\shared\Young boy nude.scr svchost.exe File created C:\Program Files (x86)\kazaa\my shared folder\NOD32 Anti-Virus v2 Keygen.exe svchost.exe File created C:\Program Files (x86)\grokster\my grokster\Sony Vegas 9 Keygen.exe svchost.exe File created C:\Program Files (x86)\kazaa lite k++\my shared folder\Nero 8 Keygen.exe svchost.exe File created C:\Program Files (x86)\bearshare\shared\Microsoft Windows Vista Home Premium Crack.exe svchost.exe File created C:\Program Files (x86)\winmx\shared\Norton Internet Security - 2009 Crack.exe svchost.exe File created C:\Program Files (x86)\winmx\shared\DivX Pro + KeyGen.exe svchost.exe File created C:\Program Files (x86)\kazaa lite\my shared folder\Kaspersky Antivirus 2009 Keygen.exe svchost.exe File created C:\Program Files (x86)\kazaa lite\my shared folder\teen sex.scr svchost.exe File created C:\Program Files (x86)\kazaa lite\my shared folder\Microsoft Visual C++ KeyGen.exe svchost.exe File created C:\Program Files (x86)\kazaa\my shared folder\Microsoft Visual Basic KeyGen.exe svchost.exe File created C:\Program Files (x86)\kazaa lite\my shared folder\Microsoft Windows Vista Home Premium Crack.exe svchost.exe File created C:\Program Files (x86)\kazaa lite k++\my shared folder\Kaspersky Antivirus 2009 Crack.exe svchost.exe File created C:\Program Files (x86)\icq\shared folder\WinRAR Crack.exe svchost.exe File created C:\Program Files (x86)\bearshare pro\shared\MSN Spammer\Nudger.exe svchost.exe File created C:\Program Files (x86)\edonkey2000\incoming\NOD32 Anti-Virus v3 Crack.exe svchost.exe File created C:\Program Files (x86)\emule\incoming\Sony Vegas 9 Crack.exe svchost.exe File created C:\Program Files (x86)\morpheus\my shared folder\WinRAR Keygen.exe svchost.exe File created C:\Program Files (x86)\kazaa lite\my shared folder\MSN Password Cracker.exe svchost.exe File created C:\Program Files (x86)\kazaa lite k++\my shared folder\Microsoft Windows Vista Crack.exe svchost.exe File created C:\Program Files (x86)\winmx\shared\Sony Vegas 9 Crack.exe svchost.exe File created C:\Program Files (x86)\bearshare pro\shared\Steam KeyGen.exe svchost.exe File created C:\Program Files (x86)\winmx\shared\Keylogger.exe svchost.exe File created C:\Program Files (x86)\icq\shared folder\Avast AntiVirus Professional Keygen.exe svchost.exe File created C:\Program Files (x86)\bearshare\shared\NOD32 Anti-Virus v3 Crack.exe svchost.exe File created C:\Program Files (x86)\limewire pro\shared\MSN Password Cracker.exe svchost.exe File created C:\Program Files (x86)\winmx\shared\Nero Keygen.exe svchost.exe File created C:\Program Files (x86)\kazaa\my shared folder\Windows XP Activation Keygen.exe svchost.exe File created C:\Program Files (x86)\icq\shared folder\NOD32 Anti-Virus v3 Keygen.exe svchost.exe File created C:\Program Files (x86)\icq\shared folder\Sony Vegas 9 Keygen.exe svchost.exe File created C:\Program Files (x86)\icq\shared folder\Young boy nude.scr svchost.exe File created C:\Program Files (x86)\bearshare pro\shared\NOD32 Anti-Virus v3 Crack.exe svchost.exe File created C:\Program Files (x86)\emule\incoming\Steam KeyGen.exe svchost.exe File created C:\Program Files (x86)\kazaa lite\my shared folder\Windows XP Activation Keygen.exe svchost.exe File created C:\Program Files (x86)\kazaa lite k++\my shared folder\MSN Spammer\Nudger.exe svchost.exe File created C:\Program Files (x86)\emule\incoming\Avast AntiVirus Professional Crack.exe svchost.exe File created C:\Program Files (x86)\limewire\shared\Microsoft Windows Vista Keygen.exe svchost.exe File created C:\Program Files (x86)\grokster\my grokster\Microsoft Windows Vista Crack.exe svchost.exe File created C:\Program Files (x86)\grokster\my grokster\MSN Spammer\Nudger.exe svchost.exe File created C:\Program Files (x86)\emule\incoming\Microsoft Visual Studio KeyGen.exe svchost.exe File created C:\Program Files (x86)\limewire\shared\Windows XP Validator Crack.exe svchost.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\svchost.exe 71d731c54be425abff3ff46d8ecc2f45_JaffaCakes118.exe File opened for modification C:\Windows\svchost.exe 71d731c54be425abff3ff46d8ecc2f45_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 71d731c54be425abff3ff46d8ecc2f45_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 71d731c54be425abff3ff46d8ecc2f45_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2760 wrote to memory of 2880 2760 71d731c54be425abff3ff46d8ecc2f45_JaffaCakes118.exe 30 PID 2760 wrote to memory of 2880 2760 71d731c54be425abff3ff46d8ecc2f45_JaffaCakes118.exe 30 PID 2760 wrote to memory of 2880 2760 71d731c54be425abff3ff46d8ecc2f45_JaffaCakes118.exe 30 PID 2760 wrote to memory of 2880 2760 71d731c54be425abff3ff46d8ecc2f45_JaffaCakes118.exe 30 PID 2760 wrote to memory of 2880 2760 71d731c54be425abff3ff46d8ecc2f45_JaffaCakes118.exe 30 PID 2760 wrote to memory of 2880 2760 71d731c54be425abff3ff46d8ecc2f45_JaffaCakes118.exe 30 PID 2760 wrote to memory of 2880 2760 71d731c54be425abff3ff46d8ecc2f45_JaffaCakes118.exe 30 PID 2760 wrote to memory of 2880 2760 71d731c54be425abff3ff46d8ecc2f45_JaffaCakes118.exe 30 PID 2880 wrote to memory of 2624 2880 71d731c54be425abff3ff46d8ecc2f45_JaffaCakes118.exe 31 PID 2880 wrote to memory of 2624 2880 71d731c54be425abff3ff46d8ecc2f45_JaffaCakes118.exe 31 PID 2880 wrote to memory of 2624 2880 71d731c54be425abff3ff46d8ecc2f45_JaffaCakes118.exe 31 PID 2880 wrote to memory of 2624 2880 71d731c54be425abff3ff46d8ecc2f45_JaffaCakes118.exe 31 PID 2624 wrote to memory of 2776 2624 svchost.exe 32 PID 2624 wrote to memory of 2776 2624 svchost.exe 32 PID 2624 wrote to memory of 2776 2624 svchost.exe 32 PID 2624 wrote to memory of 2776 2624 svchost.exe 32 PID 2624 wrote to memory of 2776 2624 svchost.exe 32 PID 2624 wrote to memory of 2776 2624 svchost.exe 32 PID 2624 wrote to memory of 2776 2624 svchost.exe 32 PID 2624 wrote to memory of 2776 2624 svchost.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\71d731c54be425abff3ff46d8ecc2f45_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\71d731c54be425abff3ff46d8ecc2f45_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\71d731c54be425abff3ff46d8ecc2f45_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\71d731c54be425abff3ff46d8ecc2f45_JaffaCakes118.exe"2⤵
- Modifies firewall policy service
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2776
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46KB
MD571d731c54be425abff3ff46d8ecc2f45
SHA14979018a4cb386b90561ea2c4f6f32575e91548a
SHA25664a8fd864c78836904744aad425c4c0e7bb988078560b0c35cffaf7442b434b2
SHA512f6d761f62a77910929648c132fbb1b5f4098e01b79e3cfd8e3614d4e015a9f50c086cb46130ef9555f53b3b8ad3b006268b00f60cc16d7c0214602ae8a1c3363