Analysis
-
max time kernel
133s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19/08/2024, 06:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe
-
Size
185KB
-
MD5
a9edce2d321bd8a5964e670a904eee53
-
SHA1
d22f26749ed2a13ad914d54e3e222038280abd45
-
SHA256
6d29e7c2c1645b147eecf5fa1e862b9f80db315b679a45e52fe184fe27d6ac5b
-
SHA512
0157fa7a82553445113af8ff4c29f85c9b1d7bd79f50a6d267edd3c6b4c9437acb61389726214dc59db7124ee9e91806f4899c3f73262cad7caa1663212f3fb3
-
SSDEEP
1536:y9bwPgJnWEMAAF6OpCzd3SxE4PsBttgJME/RT6M01xaDCCl2MrZ4J03mRot+H2Od:/SvvOq3SxETXgJMEJC8mMrZ53mGOoutj
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 1048 a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\p: a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe File opened (read-only) \??\q: a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe File opened (read-only) \??\v: a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe File opened (read-only) \??\x: a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe File opened (read-only) \??\z: a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe File opened (read-only) \??\i: a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe File opened (read-only) \??\j: a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe File opened (read-only) \??\s: a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe File opened (read-only) \??\y: a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe File opened (read-only) \??\w: a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe File opened (read-only) \??\e: a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe File opened (read-only) \??\g: a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe File opened (read-only) \??\h: a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe File opened (read-only) \??\l: a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe File opened (read-only) \??\m: a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe File opened (read-only) \??\r: a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe File opened (read-only) \??\u: a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe File opened (read-only) \??\k: a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe File opened (read-only) \??\n: a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe File opened (read-only) \??\o: a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe File opened (read-only) \??\t: a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\240629359.OCX a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\realteck\heoifz.pif a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\realteck\heoifz.pif a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED} a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InProcServer32\ = "C:\\Windows\\SysWow64\\240629359.OCX" a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InProcServer32 a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1048 a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe 1048 a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe 1048 a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe 1048 a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe 1048 a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe 1048 a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe 1048 a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe 1048 a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe 1048 a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe 1048 a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe 1048 a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe 1048 a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe 1048 a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe 1048 a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe 1048 a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe 1048 a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe 1048 a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe 1048 a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe 1048 a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe 1048 a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe 1048 a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe 1048 a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe 1048 a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe 1048 a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe 1048 a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe 1048 a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe 1048 a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe 1048 a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe 1048 a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe 1048 a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe 1048 a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe 1048 a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe 1048 a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe 1048 a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe 1048 a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe 1048 a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe 1048 a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe 1048 a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe 1048 a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe 1048 a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe 1048 a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe 1048 a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe 1048 a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe 1048 a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe 1048 a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe 1048 a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe 1048 a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe 1048 a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe 1048 a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe 1048 a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe 1048 a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe 1048 a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe 1048 a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe 1048 a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe 1048 a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe 1048 a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe 1048 a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe 1048 a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe 1048 a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe 1048 a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe 1048 a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe 1048 a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe 1048 a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe 1048 a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1048 a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe Token: SeDebugPrivilege 1048 a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a9edce2d321bd8a5964e670a904eee53_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1048
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12.2MB
MD57a99899d9c721e5aad8c547f17ac7261
SHA136938a1530d1aca71691d9df70431eaba53398c9
SHA256e103ca336abf4f80a4001f12853b53b4b84585752d5f265cd9b0f3a4208f1cd3
SHA512903b5f4e9c2cf7af5baa774a3fa8b200252097a4abef029e11cd727f1ecac55b6bd753c58b0c283f42b20f867bfcd34dda0793c4d1967011163cc5eb595a5629