Analysis
-
max time kernel
24s -
max time network
30s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
26-07-2024 03:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7279c73e1ddf0b32d80580b34d5ec081_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
7279c73e1ddf0b32d80580b34d5ec081_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
7279c73e1ddf0b32d80580b34d5ec081_JaffaCakes118.exe
-
Size
399KB
-
MD5
7279c73e1ddf0b32d80580b34d5ec081
-
SHA1
2ea5d905f0b14a278d0ed75845e2d6326cb5626f
-
SHA256
5662579ddb65b97309c00c24a5a989bd2319e74246e589eedc2cb46311c606bb
-
SHA512
f5e3d670b6c172ea3396ef6878ee3600757759c7227a95196ae26ac96e545908b9e373d818ee2fd0a27bca4792b0d8e356f686d2df95549335a4315b78eae391
-
SSDEEP
768:/1antS8YzXBWx3A62DQjm3zF/pxP+A02mgjSUnJ:/1YUFrcx3APDo0zFHmqSC
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\WINDOWS\system32\drivers\etc\hosts csrss.exe -
Executes dropped EXE 1 IoCs
pid Process 2428 csrss.exe -
Loads dropped DLL 2 IoCs
pid Process 2268 7279c73e1ddf0b32d80580b34d5ec081_JaffaCakes118.exe 2268 7279c73e1ddf0b32d80580b34d5ec081_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\win_cpl = "C:\\windows\\system\\csrss.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\kernel = "C:\\windows\\system\\csrss.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\winNT = "C:\\windows\\system\\csrss.exe" csrss.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\QFile\Upload\???_??.exe csrss.exe File opened for modification C:\Program Files\QFile\Upload\??? ?? ???? ??? ??,crack-inc1.exe csrss.exe File opened for modification C:\Program Files\QFile\Upload\?? ? ??.exe csrss.exe File opened for modification C:\Program Files\QFile\Upload\??-??.exe csrss.exe File opened for modification C:\Program Files\QFile\Upload\??? 8.0 CS(PHOTOSHOP CS)(TDA? ?? ??? ??????? + ????).exe csrss.exe File opened for modification C:\Program Files\QFile\Upload\GTA SanAndreasCrack.exe csrss.exe File opened for modification C:\Program Files\QFile\Upload\????1(COMMANDOS)??.exe csrss.exe File opened for modification C:\Program Files\QFile\Upload\hacking Program.exe csrss.exe File opened for modification C:\Program Files\QFile\Upload\???? ????.exe csrss.exe File opened for modification C:\Program Files\QFile\Upload\abcdefghijklmnopqrstuvwxyz.exe csrss.exe File opened for modification C:\Program Files\QFile\Upload\???(aoi sora-AV?? ??? ??? ???) (????)(.avi).exe csrss.exe File opened for modification C:\Program Files\QFile\Upload\[??] sakurako tokiwa - ? ?? ?? av ??.avi(.avi).exe csrss.exe File created C:\Program Files\QFile\Upload\lesbia.exe csrss.exe File opened for modification C:\Program Files\QFile\Upload\a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w.x.y.z.jpg.bmp.gif.avi.txt.exe csrss.exe File opened for modification C:\Program Files\QFile\Upload\???? ???? ????(av).exe csrss.exe File opened for modification C:\Program Files\QFile\Upload\(@??)???????.??? ????6.0(??????,??? C++).????? ??????.exe csrss.exe File opened for modification C:\Program Files\QFile\Upload\Honoka (???) [????AV??] 2006-10-07 ???.avi_)))(.avi).exe csrss.exe File opened for modification C:\Program Files\QFile\Upload\???? (Far Cry) v1.3 Patch & Crack.exe csrss.exe File opened for modification C:\Program Files\QFile\Upload\????.??av.¦2007=00?¦=Magic Banana Mb-077(.avi).exe csrss.exe File opened for modification C:\Program Files\QFile\Upload\??.exe csrss.exe File opened for modification C:\Program Files\QFile\Upload\???????3se,crack-inc.exe csrss.exe File opened for modification C:\Program Files\QFile\Upload\?3 ??,crack-inc.exe csrss.exe File opened for modification C:\Program Files\QFile\Upload\?? ?? ? ?? ??,crack-inc.exe csrss.exe File opened for modification C:\Program Files\QFile\Upload\??? 7.0 ??????? + ????).exe csrss.exe File opened for modification C:\Program Files\QFile\Upload\??????? ?? (???) - ??,??.exe csrss.exe File opened for modification C:\Program Files\QFile\Upload\Vista ????(OEM Bios Crack).exe csrss.exe File created C:\Program Files\QFile\Upload\AstrawareSolitaire_crack.exe csrss.exe File created C:\Program Files\QFile\Upload\FIFA2007 keygen.exe csrss.exe File created C:\Program Files\QFile\Upload\Adobe Photoshop keygen.exe csrss.exe File opened for modification C:\Program Files\QFile\Upload\?????3 ??? warcraft iii the frozenthron ????.exe csrss.exe File opened for modification C:\Program Files\QFile\Upload\??2002 ???.exe csrss.exe File created C:\Program Files\QFile\Upload\Windows xp Home Edition sp2(.iso).exe csrss.exe File opened for modification C:\Program Files\QFile\Upload\??? ????6.0(??????,??? C).exe csrss.exe File opened for modification C:\Program Files\QFile\Upload\[?? AV] ?? ??? -??? ??? Sora Aoi - ?????????[S1].avi(.avi).exe csrss.exe File opened for modification C:\Program Files\QFile\Upload\??????1.exe csrss.exe File opened for modification C:\Program Files\QFile\Upload\???? - V.O.S-(.mp3).exe csrss.exe File created C:\Program Files\QFile\Upload\Adobe Photoshop Cs2 Activation Crack.exe csrss.exe File created C:\Program Files\QFile\Upload\NOD32 2.70.39 Korean Start Kit v1.4.0.6 Setup.exe csrss.exe File opened for modification C:\Program Files\QFile\Upload\Windows xp Home ??????.exe csrss.exe File opened for modification C:\Program Files\QFile\Upload\??????? ??? 98 SE(Microsoft Windows 98 SE).exe csrss.exe File opened for modification C:\Program Files\QFile\Upload\?????? ????(??exe??).exe csrss.exe File opened for modification C:\Program Files\QFile\Upload\UltraEdit-32 v11.20b.Key (???).exe csrss.exe File opened for modification C:\Program Files\QFile\Upload\????.??av.¦2007=00?¦=Japanese Uncensored Hardcore Av Lv-001 ??? (.avi).exe csrss.exe File created C:\Program Files\QFile\Upload\GTA SanAndreasCrack.exe csrss.exe File opened for modification C:\Program Files\QFile\Upload\[??? ??? ??? 3D] windows vista korean edition.crack.exe csrss.exe File opened for modification C:\Program Files\QFile\Upload\(??)05? 6? ??? AV ??.wmv.exe csrss.exe File opened for modification C:\Program Files\QFile\Upload\??????? ?????(ps2emul)(av).exe csrss.exe File opened for modification C:\Program Files\QFile\Upload\?? ??.v1.9.6.4719.Retail.Multilangages.Incl-Crack.exe csrss.exe File opened for modification C:\Program Files\QFile\Upload\[??-???]Adobe Photoshop 8.0 CS.exe csrss.exe File opened for modification C:\Program Files\QFile\Upload\lesbian.exe csrss.exe File opened for modification C:\Program Files\QFile\Upload\????????(?)?? ?? av 17? super idol - ai nagase ?? ??? ???(?? ?? ?? ?? ?? ?? ??? ?? ?? ?? ?3)(.avi).exe csrss.exe File opened for modification C:\Program Files\QFile\Upload\???(one piece) ??? 2?-?????? ??._________________(avi).exe csrss.exe File opened for modification C:\Program Files\QFile\Upload\[PC??]?l?2005.FIFA2005.??.exe csrss.exe File opened for modification C:\Program Files\QFile\Upload\??? 7.0 ??.exe csrss.exe File opened for modification C:\Program Files\QFile\Upload\????? ????? v10.0.4942 ??? ????.exe csrss.exe File opened for modification C:\Program Files\QFile\Upload\????????2007_??.exe csrss.exe File opened for modification C:\Program Files\QFile\Upload\??? XP Vol SP2 Ko(??) ????.exe csrss.exe File opened for modification C:\Program Files\QFile\Upload\WM.Recorder.v10.0.WinALL.Cracked-ViRiLiTY.exe csrss.exe File opened for modification C:\Program Files\QFile\Upload\Gun-????(??,??,??).exe csrss.exe File opened for modification C:\Program Files\QFile\Upload\botipx csrss.exe File opened for modification C:\Program Files\QFile\Upload\[??] (??) (???) ???? ?? ??! - MS Royale Theme Pack for WinXP v2.(zip).exe csrss.exe File opened for modification C:\Program Files\QFile\Upload\nfsc crack,keygen.exe csrss.exe File opened for modification C:\Program Files\QFile\Upload\????.??av.¦2007=00?¦=Caribbeancom.com ??? ?? ?? (.avi).exe csrss.exe File opened for modification C:\Program Files\QFile\Upload\???(one piece) ??? 7?-?????? ???? -02_________________avi..exe csrss.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\windows\system\csrss.exe 7279c73e1ddf0b32d80580b34d5ec081_JaffaCakes118.exe File opened for modification C:\windows\system\csrss.exe 7279c73e1ddf0b32d80580b34d5ec081_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7279c73e1ddf0b32d80580b34d5ec081_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2268 7279c73e1ddf0b32d80580b34d5ec081_JaffaCakes118.exe 2428 csrss.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2268 wrote to memory of 2428 2268 7279c73e1ddf0b32d80580b34d5ec081_JaffaCakes118.exe 30 PID 2268 wrote to memory of 2428 2268 7279c73e1ddf0b32d80580b34d5ec081_JaffaCakes118.exe 30 PID 2268 wrote to memory of 2428 2268 7279c73e1ddf0b32d80580b34d5ec081_JaffaCakes118.exe 30 PID 2268 wrote to memory of 2428 2268 7279c73e1ddf0b32d80580b34d5ec081_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\7279c73e1ddf0b32d80580b34d5ec081_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\7279c73e1ddf0b32d80580b34d5ec081_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\windows\system\csrss.exe\windows\system\csrss.exe2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2428
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
399KB
MD57279c73e1ddf0b32d80580b34d5ec081
SHA12ea5d905f0b14a278d0ed75845e2d6326cb5626f
SHA2565662579ddb65b97309c00c24a5a989bd2319e74246e589eedc2cb46311c606bb
SHA512f5e3d670b6c172ea3396ef6878ee3600757759c7227a95196ae26ac96e545908b9e373d818ee2fd0a27bca4792b0d8e356f686d2df95549335a4315b78eae391