Analysis
-
max time kernel
138s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
17-08-2024 12:48
Static task
static1
Behavioral task
behavioral1
Sample
a2979fe9cc6cdfef0f36e6079f11a0ef_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
a2979fe9cc6cdfef0f36e6079f11a0ef_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a2979fe9cc6cdfef0f36e6079f11a0ef_JaffaCakes118.exe
-
Size
592KB
-
MD5
a2979fe9cc6cdfef0f36e6079f11a0ef
-
SHA1
f0d213befc2b617837f4c73e82f135a9b03bd1e9
-
SHA256
f5e144e546913f82d4a09e7651d810acef969dccc81bf326aaae8cc9a2c3ce5a
-
SHA512
7b6d2ecb46a06d48ce5959e2b83f17fa53eda20db5a719bc627f40f24dcbe9fd849ddc295f1fc010d6c474b3558bb65a7f33b2ff966597defa50bd8a10485661
-
SSDEEP
6144:8CE6/mUXJ531nIUliViSZbLhaZfvMlLXICg2vj7OyzWxzRazUE1K52u8iqUNr6:86TOUMBQf0ljW2vj7OyzoRaA+e
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4208 2112 WerFault.exe winver.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
a2979fe9cc6cdfef0f36e6079f11a0ef_JaffaCakes118.exewinver.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a2979fe9cc6cdfef0f36e6079f11a0ef_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winver.exe -
Modifies registry class 2 IoCs
Processes:
Explorer.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
winver.exepid process 2112 winver.exe 2112 winver.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
Processes:
Explorer.EXEdescription pid process Token: SeShutdownPrivilege 3564 Explorer.EXE Token: SeCreatePagefilePrivilege 3564 Explorer.EXE Token: SeShutdownPrivilege 3564 Explorer.EXE Token: SeCreatePagefilePrivilege 3564 Explorer.EXE Token: SeShutdownPrivilege 3564 Explorer.EXE Token: SeCreatePagefilePrivilege 3564 Explorer.EXE Token: SeShutdownPrivilege 3564 Explorer.EXE Token: SeCreatePagefilePrivilege 3564 Explorer.EXE Token: SeShutdownPrivilege 3564 Explorer.EXE Token: SeCreatePagefilePrivilege 3564 Explorer.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
winver.exepid process 2112 winver.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3564 Explorer.EXE -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
a2979fe9cc6cdfef0f36e6079f11a0ef_JaffaCakes118.exewinver.exedescription pid process target process PID 4652 wrote to memory of 2112 4652 a2979fe9cc6cdfef0f36e6079f11a0ef_JaffaCakes118.exe winver.exe PID 4652 wrote to memory of 2112 4652 a2979fe9cc6cdfef0f36e6079f11a0ef_JaffaCakes118.exe winver.exe PID 4652 wrote to memory of 2112 4652 a2979fe9cc6cdfef0f36e6079f11a0ef_JaffaCakes118.exe winver.exe PID 4652 wrote to memory of 2112 4652 a2979fe9cc6cdfef0f36e6079f11a0ef_JaffaCakes118.exe winver.exe PID 2112 wrote to memory of 3564 2112 winver.exe Explorer.EXE PID 2112 wrote to memory of 2580 2112 winver.exe sihost.exe
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2580
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\a2979fe9cc6cdfef0f36e6079f11a0ef_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a2979fe9cc6cdfef0f36e6079f11a0ef_JaffaCakes118.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Windows\SysWOW64\winver.exewinver3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 6364⤵
- Program crash
PID:4208
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2112 -ip 21121⤵PID:2444