Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
12/08/2024, 02:37
Static task
static1
Behavioral task
behavioral1
Sample
8cfbfe8e3c17f190a1f6a05751b73ada_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
8cfbfe8e3c17f190a1f6a05751b73ada_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
8cfbfe8e3c17f190a1f6a05751b73ada_JaffaCakes118.exe
-
Size
153KB
-
MD5
8cfbfe8e3c17f190a1f6a05751b73ada
-
SHA1
573204ceb3634b926efb2d86a061848d9074f0f4
-
SHA256
e85c8b5da59de4dca4e3ba59437c0685b61ed3dba87f5db2deb618a6793cd1c8
-
SHA512
e4e2dae353fb26c1ec215f94ba6e4707f96519907a6d912edf034806bc2bef247247c4462bedead919fb9c06474878d9ec0eefe357d6722cc13f7957ef87a2f5
-
SSDEEP
3072:RS/4DDEifl+aMvJ2OpgDP0PHzFDt8WvCxmK4nG8SuNIZ91p3/Eq8:o6Df8S0/zFx7CaGTD3/Ev
Malware Config
Signatures
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8cfbfe8e3c17f190a1f6a05751b73ada_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Kills process with taskkill 3 IoCs
pid Process 1764 taskkill.exe 2152 taskkill.exe 2280 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2280 taskkill.exe Token: SeDebugPrivilege 2152 taskkill.exe Token: SeDebugPrivilege 1764 taskkill.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3020 8cfbfe8e3c17f190a1f6a05751b73ada_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 3020 wrote to memory of 2280 3020 8cfbfe8e3c17f190a1f6a05751b73ada_JaffaCakes118.exe 30 PID 3020 wrote to memory of 2280 3020 8cfbfe8e3c17f190a1f6a05751b73ada_JaffaCakes118.exe 30 PID 3020 wrote to memory of 2280 3020 8cfbfe8e3c17f190a1f6a05751b73ada_JaffaCakes118.exe 30 PID 3020 wrote to memory of 2280 3020 8cfbfe8e3c17f190a1f6a05751b73ada_JaffaCakes118.exe 30 PID 3020 wrote to memory of 2092 3020 8cfbfe8e3c17f190a1f6a05751b73ada_JaffaCakes118.exe 31 PID 3020 wrote to memory of 2092 3020 8cfbfe8e3c17f190a1f6a05751b73ada_JaffaCakes118.exe 31 PID 3020 wrote to memory of 2092 3020 8cfbfe8e3c17f190a1f6a05751b73ada_JaffaCakes118.exe 31 PID 3020 wrote to memory of 2092 3020 8cfbfe8e3c17f190a1f6a05751b73ada_JaffaCakes118.exe 31 PID 3020 wrote to memory of 2360 3020 8cfbfe8e3c17f190a1f6a05751b73ada_JaffaCakes118.exe 33 PID 3020 wrote to memory of 2360 3020 8cfbfe8e3c17f190a1f6a05751b73ada_JaffaCakes118.exe 33 PID 3020 wrote to memory of 2360 3020 8cfbfe8e3c17f190a1f6a05751b73ada_JaffaCakes118.exe 33 PID 3020 wrote to memory of 2360 3020 8cfbfe8e3c17f190a1f6a05751b73ada_JaffaCakes118.exe 33 PID 3020 wrote to memory of 1764 3020 8cfbfe8e3c17f190a1f6a05751b73ada_JaffaCakes118.exe 39 PID 3020 wrote to memory of 1764 3020 8cfbfe8e3c17f190a1f6a05751b73ada_JaffaCakes118.exe 39 PID 3020 wrote to memory of 1764 3020 8cfbfe8e3c17f190a1f6a05751b73ada_JaffaCakes118.exe 39 PID 3020 wrote to memory of 1764 3020 8cfbfe8e3c17f190a1f6a05751b73ada_JaffaCakes118.exe 39 PID 3020 wrote to memory of 2152 3020 8cfbfe8e3c17f190a1f6a05751b73ada_JaffaCakes118.exe 40 PID 3020 wrote to memory of 2152 3020 8cfbfe8e3c17f190a1f6a05751b73ada_JaffaCakes118.exe 40 PID 3020 wrote to memory of 2152 3020 8cfbfe8e3c17f190a1f6a05751b73ada_JaffaCakes118.exe 40 PID 3020 wrote to memory of 2152 3020 8cfbfe8e3c17f190a1f6a05751b73ada_JaffaCakes118.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\8cfbfe8e3c17f190a1f6a05751b73ada_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8cfbfe8e3c17f190a1f6a05751b73ada_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im 99Lover.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2280
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c del /f /s /q "%userprofile%\Local Settings\Temporary Internet Files\*.*"2⤵
- System Location Discovery: System Language Discovery
PID:2092
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c del "C:\Users\Admin\Cookies" /Q, vbHide2⤵
- System Location Discovery: System Language Discovery
PID:2360
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im 99Lover.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1764
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im 99Lover.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2152
-