Analysis
-
max time kernel
134s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
26/08/2024, 03:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe
-
Size
35KB
-
MD5
c236337c73bf24b77b420964410ece8b
-
SHA1
8f88e07eca87c28d28575ca8ba1c47a907929a2e
-
SHA256
9dd7f1e1e9c2f5553af49fb5a652d4d8d824293199e6fd96d920ca5cb6135413
-
SHA512
3bf48d3435ba784a63e55bf544e0d762a6b755d5efd3b3f055a9ab8dc708eee580b54ab50ca7e185ce299c1919698b31d7874072f51dbb0aa2ca805f77ea8834
-
SSDEEP
768:2zmBrHGJBFQUw+XSFIEP1VI5H9KwggeiVh4qE3TFgtliY7b42Yj/NeRyO:2mBTOBFA2Eqgg7wpq+YXG/3
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1208 yt8a.exe -
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe File opened (read-only) \??\H: c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\yt8a.exe c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe File created C:\Windows\SysWOW64\yt8a.exe c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\yt8a.exe yt8a.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yt8a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 660 Process not Found 660 Process not Found -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe Token: SeDebugPrivilege 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe Token: SeDebugPrivilege 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe Token: SeDebugPrivilege 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe Token: SeDebugPrivilege 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe Token: SeDebugPrivilege 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe Token: SeDebugPrivilege 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe Token: SeDebugPrivilege 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe Token: SeDebugPrivilege 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe Token: SeDebugPrivilege 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe Token: SeDebugPrivilege 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe Token: SeDebugPrivilege 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe Token: SeDebugPrivilege 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe Token: SeDebugPrivilege 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe Token: SeDebugPrivilege 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe Token: SeDebugPrivilege 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe Token: SeDebugPrivilege 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe Token: SeDebugPrivilege 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe Token: SeDebugPrivilege 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe Token: SeDebugPrivilege 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe Token: SeDebugPrivilege 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe Token: SeDebugPrivilege 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe Token: SeDebugPrivilege 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe Token: SeDebugPrivilege 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe Token: SeDebugPrivilege 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe Token: SeDebugPrivilege 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe Token: SeDebugPrivilege 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe Token: SeDebugPrivilege 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe Token: SeDebugPrivilege 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe Token: SeDebugPrivilege 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe Token: SeDebugPrivilege 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe Token: SeDebugPrivilege 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe Token: SeDebugPrivilege 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe Token: SeDebugPrivilege 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe Token: SeDebugPrivilege 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe Token: SeDebugPrivilege 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe Token: SeDebugPrivilege 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe Token: SeDebugPrivilege 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe Token: SeDebugPrivilege 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe Token: SeDebugPrivilege 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe Token: SeDebugPrivilege 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe Token: SeDebugPrivilege 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe Token: SeDebugPrivilege 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe Token: SeDebugPrivilege 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe Token: SeDebugPrivilege 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe Token: SeDebugPrivilege 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe Token: SeDebugPrivilege 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe Token: SeDebugPrivilege 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe Token: SeDebugPrivilege 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe Token: SeDebugPrivilege 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe Token: SeDebugPrivilege 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe Token: SeDebugPrivilege 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe Token: SeDebugPrivilege 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe Token: SeDebugPrivilege 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe Token: SeDebugPrivilege 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe Token: SeDebugPrivilege 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe Token: SeDebugPrivilege 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe Token: SeDebugPrivilege 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe Token: SeDebugPrivilege 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe Token: SeDebugPrivilege 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe Token: SeDebugPrivilege 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe Token: SeDebugPrivilege 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe Token: SeDebugPrivilege 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe Token: SeDebugPrivilege 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2532 wrote to memory of 1208 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe 90 PID 2532 wrote to memory of 1208 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe 90 PID 2532 wrote to memory of 1208 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe 90 PID 1208 wrote to memory of 2292 1208 yt8a.exe 91 PID 1208 wrote to memory of 2292 1208 yt8a.exe 91 PID 1208 wrote to memory of 2292 1208 yt8a.exe 91 PID 2532 wrote to memory of 872 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe 93 PID 2532 wrote to memory of 872 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe 93 PID 2532 wrote to memory of 872 2532 c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c236337c73bf24b77b420964410ece8b_JaffaCakes118.exe"1⤵
- Enumerates connected drives
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Windows\SysWOW64\yt8a.exeC:\Windows\system32\yt8a.exe yt8a2⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~SiGou.bat3⤵
- System Location Discovery: System Language Discovery
PID:2292
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~SiGou.bat2⤵
- System Location Discovery: System Language Discovery
PID:872
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
128B
MD55c43604c6faeeb34a05bd85d6867ad9e
SHA126eba4b6a748d515c18b7df2a34bb067f562964a
SHA2564d10d6936c1d9d16c40ae2f3520c28bf2e753a846c1c5aae8d9a359d91207af5
SHA5125d20b96e6a6edff0b9dbb8ae5f6c0aba02b1c43ec5c905f24a970b92df8d4f115921c2a364f12d8f57fab2e078a30928d669998c5281fd80d5f4f90d55688845
-
Filesize
240B
MD57444c5d7b0d755c1f53f71138345820d
SHA1534ac44f4bb5ce137006f9a4d87f899a71ea2cdb
SHA256ed7e958dd84e5595ed8f584ca2c1fa0352debe9efa2d961ee73a2a95becdd6e7
SHA51214fa241a9f1563d93641faeab2a1c331694f786d2b7b800241338e05a97b14e4c9a76b16643947b93c96dcb1893ad1f1d917f5742fde77f81415fe74dc16eb68
-
Filesize
35KB
MD5c236337c73bf24b77b420964410ece8b
SHA18f88e07eca87c28d28575ca8ba1c47a907929a2e
SHA2569dd7f1e1e9c2f5553af49fb5a652d4d8d824293199e6fd96d920ca5cb6135413
SHA5123bf48d3435ba784a63e55bf544e0d762a6b755d5efd3b3f055a9ab8dc708eee580b54ab50ca7e185ce299c1919698b31d7874072f51dbb0aa2ca805f77ea8834