Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
12-08-2024 13:03
Behavioral task
behavioral1
Sample
8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe
Resource
win7-20240729-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
15 signatures
150 seconds
General
-
Target
8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe
-
Size
27KB
-
MD5
8ed3982012a962d0153b8ac55b324eda
-
SHA1
e7dd53ad35659c9d8d1724b4b01d402275a9a868
-
SHA256
1b3fed55d6171151094506e02b25e092e01e8942bcd2ebd7b3593861992fd432
-
SHA512
a7cf556c5d75a6d632f10a298b9213cb18f9376bd1dd92d23f82340f9fcada092327c4f790b0bc20d9e6d01785eff42fb6550b8a8ae7e2cae855f97f4de6f7d1
-
SSDEEP
768:9sTR5m+7iSmAMNNZt/5aUR6NCi50l0x7CGdF0w9:9sT3L7nMNbt/xa7F/0k
Score
7/10
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x000600000001949e-7.dat acprotect -
Deletes itself 1 IoCs
pid Process 2896 cmd.exe -
Loads dropped DLL 1 IoCs
pid Process 2368 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe -
resource yara_rule behavioral1/memory/2368-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x000600000001949e-7.dat upx behavioral1/memory/2368-9-0x0000000010000000-0x0000000010010000-memory.dmp upx behavioral1/memory/2368-12-0x0000000010000000-0x0000000010010000-memory.dmp upx -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\201476D0.cfg 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\201476D0.dll 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe File created C:\Windows\SysWOW64\b1a18a3e.drv 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry class 7 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{201476D0-2B18-462E-AB9F-3E2B0CC8732B}\InprocServer32 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{201476D0-2B18-462E-AB9F-3E2B0CC8732B}\InprocServer32\ = "201476D0.dll" 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{201476D0-2B18-462E-AB9F-3E2B0CC8732B}\InprocServer32\ThreadingModel = "Apartment" 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLsID\{201476D0-2B18-462E-AB9F-3E2B0CC8732B}\InprocServer32 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLsID 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{201476D0-2B18-462E-AB9F-3E2B0CC8732B} 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2368 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe 2368 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe 2368 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe -
Suspicious behavior: LoadsDriver 3 IoCs
pid Process 472 Process not Found 472 Process not Found 472 Process not Found -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2368 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe Token: SeDebugPrivilege 2368 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe Token: SeDebugPrivilege 2368 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe Token: SeDebugPrivilege 2368 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe Token: SeDebugPrivilege 2368 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe Token: SeDebugPrivilege 2368 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe Token: SeDebugPrivilege 2368 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe Token: SeDebugPrivilege 2368 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe Token: SeDebugPrivilege 2368 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe Token: SeDebugPrivilege 2368 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe Token: SeDebugPrivilege 2368 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe Token: SeDebugPrivilege 2368 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe Token: SeDebugPrivilege 2368 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe Token: SeDebugPrivilege 2368 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe Token: SeDebugPrivilege 2368 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe Token: SeDebugPrivilege 2368 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe Token: SeDebugPrivilege 2368 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe Token: SeDebugPrivilege 2368 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe Token: SeDebugPrivilege 2368 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe Token: SeDebugPrivilege 2368 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe Token: SeDebugPrivilege 2368 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe Token: SeDebugPrivilege 2368 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe Token: SeDebugPrivilege 2368 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe Token: SeDebugPrivilege 2368 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe Token: SeDebugPrivilege 2368 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe Token: SeDebugPrivilege 2368 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe Token: SeDebugPrivilege 2368 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe Token: SeDebugPrivilege 2368 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe Token: SeDebugPrivilege 2368 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe Token: SeDebugPrivilege 2368 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe Token: SeDebugPrivilege 2368 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe Token: SeDebugPrivilege 2368 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe Token: SeDebugPrivilege 2368 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe Token: SeDebugPrivilege 2368 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe Token: SeDebugPrivilege 2368 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe Token: SeDebugPrivilege 2368 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe Token: SeDebugPrivilege 2368 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe Token: SeDebugPrivilege 2368 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe Token: SeDebugPrivilege 2368 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe Token: SeDebugPrivilege 2368 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe Token: SeDebugPrivilege 2368 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe Token: SeDebugPrivilege 2368 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe Token: SeDebugPrivilege 2368 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe Token: SeDebugPrivilege 2368 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe Token: SeDebugPrivilege 2368 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe Token: SeDebugPrivilege 2368 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe Token: SeDebugPrivilege 2368 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe Token: SeDebugPrivilege 2368 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe Token: SeDebugPrivilege 2368 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe Token: SeDebugPrivilege 2368 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe Token: SeDebugPrivilege 2368 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe Token: SeDebugPrivilege 2368 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe Token: SeDebugPrivilege 2368 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe Token: SeDebugPrivilege 2368 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe Token: SeDebugPrivilege 2368 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe Token: SeDebugPrivilege 2368 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe Token: SeDebugPrivilege 2368 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe Token: SeDebugPrivilege 2368 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe Token: SeDebugPrivilege 2368 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe Token: SeDebugPrivilege 2368 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe Token: SeDebugPrivilege 2368 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe Token: SeDebugPrivilege 2368 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe Token: SeDebugPrivilege 2368 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe Token: SeDebugPrivilege 2368 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2368 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe 2368 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2368 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2368 wrote to memory of 2896 2368 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe 31 PID 2368 wrote to memory of 2896 2368 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe 31 PID 2368 wrote to memory of 2896 2368 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe 31 PID 2368 wrote to memory of 2896 2368 8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ed3982012a962d0153b8ac55b324eda_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\8ED398~1.EXE >> NUL2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2896
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
17KB
MD56d70baea41e415b11ad483095ebe4c1c
SHA1ee2efe69efffe0f5a05222a029156d787e4b5e09
SHA256e8be6ffee1dc39cede335f2efed2aa0c7f0848dfe6ae4231a0f7105b22cf1a0f
SHA512f057cb5a16ec37917207baf2b14d80ed2dc8b9046b7b94678db9d8020114de7860e8fa30794808ad3a4f44f230f142407b1f61ed9c876609d9740a7df5693296