Analysis
-
max time kernel
97s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
14-09-2024 17:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e0b3988dfef3c8f947f2e2287ef00273_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
e0b3988dfef3c8f947f2e2287ef00273_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
e0b3988dfef3c8f947f2e2287ef00273_JaffaCakes118.exe
-
Size
36KB
-
MD5
e0b3988dfef3c8f947f2e2287ef00273
-
SHA1
d5f6942da0b5f592f207cdf5ac0d1e0fe0a98a77
-
SHA256
997b6272be181a0698a22e2e72a5e0396c1498c15751001210723dbf226c9ab1
-
SHA512
fe0d940ca4274d72528d2eb7c8a08858663f15e2c9982d8a23f81cdd463b73e900fa308e87d39b5e63885b3b64568015e772f8bb643adbd00d8c2ccdd1f75398
-
SSDEEP
384:A9cmjutMSqF69UNvgQAigJUKW7gYNoEUVBxx+:A93jutMShAvgQAiiYGB3+
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\dll\csrss.exe e0b3988dfef3c8f947f2e2287ef00273_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\srsver.dll e0b3988dfef3c8f947f2e2287ef00273_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\rsver.dll e0b3988dfef3c8f947f2e2287ef00273_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\svers.dll e0b3988dfef3c8f947f2e2287ef00273_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\dll32.exe e0b3988dfef3c8f947f2e2287ef00273_JaffaCakes118.exe File opened for modification C:\Windows\zip\services.exe e0b3988dfef3c8f947f2e2287ef00273_JaffaCakes118.exe File opened for modification C:\Windows\vts\services.exe e0b3988dfef3c8f947f2e2287ef00273_JaffaCakes118.exe File opened for modification C:\Windows\display\services.exe e0b3988dfef3c8f947f2e2287ef00273_JaffaCakes118.exe File opened for modification C:\Windows\rpool\smss.exe e0b3988dfef3c8f947f2e2287ef00273_JaffaCakes118.exe File opened for modification C:\Windows\DCom.exe e0b3988dfef3c8f947f2e2287ef00273_JaffaCakes118.exe File opened for modification C:\Windows\syst.exe e0b3988dfef3c8f947f2e2287ef00273_JaffaCakes118.exe File opened for modification C:\Windows\Mscom32.exe e0b3988dfef3c8f947f2e2287ef00273_JaffaCakes118.exe File opened for modification C:\Windows\Msapp.exe e0b3988dfef3c8f947f2e2287ef00273_JaffaCakes118.exe File opened for modification C:\Windows\winvid.exe e0b3988dfef3c8f947f2e2287ef00273_JaffaCakes118.exe File opened for modification C:\Windows\isas\services.exe e0b3988dfef3c8f947f2e2287ef00273_JaffaCakes118.exe File opened for modification C:\Windows\winusers.exe e0b3988dfef3c8f947f2e2287ef00273_JaffaCakes118.exe File opened for modification C:\Windows\csrss.exe e0b3988dfef3c8f947f2e2287ef00273_JaffaCakes118.exe File opened for modification C:\Windows\OutlookExpress.exe e0b3988dfef3c8f947f2e2287ef00273_JaffaCakes118.exe File opened for modification C:\Windows\sm.exe e0b3988dfef3c8f947f2e2287ef00273_JaffaCakes118.exe File opened for modification C:\Windows\MsDtc\smss.exe e0b3988dfef3c8f947f2e2287ef00273_JaffaCakes118.exe File opened for modification C:\Windows\msndebug\lsass.exe e0b3988dfef3c8f947f2e2287ef00273_JaffaCakes118.exe File opened for modification C:\Windows\netcom.exe e0b3988dfef3c8f947f2e2287ef00273_JaffaCakes118.exe File opened for modification C:\Windows\taskmgr.exe e0b3988dfef3c8f947f2e2287ef00273_JaffaCakes118.exe File opened for modification C:\Windows\rpool\services.exe e0b3988dfef3c8f947f2e2287ef00273_JaffaCakes118.exe File opened for modification C:\Windows\spool\cmss.exe e0b3988dfef3c8f947f2e2287ef00273_JaffaCakes118.exe File opened for modification C:\Windows\vdzones\cmss.exe e0b3988dfef3c8f947f2e2287ef00273_JaffaCakes118.exe File opened for modification C:\Windows\comp.exe e0b3988dfef3c8f947f2e2287ef00273_JaffaCakes118.exe File opened for modification C:\Windows\OSdebug\smss.exe e0b3988dfef3c8f947f2e2287ef00273_JaffaCakes118.exe File opened for modification C:\Windows\data\csrss.exe e0b3988dfef3c8f947f2e2287ef00273_JaffaCakes118.exe File opened for modification C:\Windows\drivers\smss.exe e0b3988dfef3c8f947f2e2287ef00273_JaffaCakes118.exe File opened for modification C:\Windows\winup32.exe e0b3988dfef3c8f947f2e2287ef00273_JaffaCakes118.exe File opened for modification C:\Windows\winsyst.exe e0b3988dfef3c8f947f2e2287ef00273_JaffaCakes118.exe File opened for modification C:\Windows\unir.exe e0b3988dfef3c8f947f2e2287ef00273_JaffaCakes118.exe File opened for modification C:\Windows\Outlook.exe e0b3988dfef3c8f947f2e2287ef00273_JaffaCakes118.exe File opened for modification C:\Windows\data\services.exe e0b3988dfef3c8f947f2e2287ef00273_JaffaCakes118.exe File opened for modification C:\Windows\isas\smss.exe e0b3988dfef3c8f947f2e2287ef00273_JaffaCakes118.exe File opened for modification C:\Windows\msn.exe e0b3988dfef3c8f947f2e2287ef00273_JaffaCakes118.exe File opened for modification C:\Windows\msn64.exe e0b3988dfef3c8f947f2e2287ef00273_JaffaCakes118.exe File opened for modification C:\Windows\svers.dll e0b3988dfef3c8f947f2e2287ef00273_JaffaCakes118.exe File opened for modification C:\Windows\outlook.exe e0b3988dfef3c8f947f2e2287ef00273_JaffaCakes118.exe File opened for modification C:\Windows\dll\smss32.exe e0b3988dfef3c8f947f2e2287ef00273_JaffaCakes118.exe File opened for modification C:\Windows\dhcp\smss.exe e0b3988dfef3c8f947f2e2287ef00273_JaffaCakes118.exe File opened for modification C:\Windows\vdzones\lsass.exe e0b3988dfef3c8f947f2e2287ef00273_JaffaCakes118.exe File opened for modification C:\Windows\makensis.exe e0b3988dfef3c8f947f2e2287ef00273_JaffaCakes118.exe File opened for modification C:\Windows\svchost.exe e0b3988dfef3c8f947f2e2287ef00273_JaffaCakes118.exe File opened for modification C:\Windows\Outlook32.exe e0b3988dfef3c8f947f2e2287ef00273_JaffaCakes118.exe File opened for modification C:\Windows\vzones\smss.exe e0b3988dfef3c8f947f2e2287ef00273_JaffaCakes118.exe File opened for modification C:\Windows\srsver.dll e0b3988dfef3c8f947f2e2287ef00273_JaffaCakes118.exe File opened for modification C:\Windows\msimn.exe e0b3988dfef3c8f947f2e2287ef00273_JaffaCakes118.exe File opened for modification C:\Windows\ziplogs\csrss.exe e0b3988dfef3c8f947f2e2287ef00273_JaffaCakes118.exe File opened for modification C:\Windows\ziplogs\services.exe e0b3988dfef3c8f947f2e2287ef00273_JaffaCakes118.exe File opened for modification C:\Windows\img32\services.exe e0b3988dfef3c8f947f2e2287ef00273_JaffaCakes118.exe File opened for modification C:\Windows\dhcp\services.exe e0b3988dfef3c8f947f2e2287ef00273_JaffaCakes118.exe File opened for modification C:\Windows\OSdebug\services.exe e0b3988dfef3c8f947f2e2287ef00273_JaffaCakes118.exe File opened for modification C:\Windows\ijl11.dll e0b3988dfef3c8f947f2e2287ef00273_JaffaCakes118.exe File opened for modification C:\Windows\misi.exe e0b3988dfef3c8f947f2e2287ef00273_JaffaCakes118.exe File opened for modification C:\Windows\img32\csrss.exe e0b3988dfef3c8f947f2e2287ef00273_JaffaCakes118.exe File opened for modification C:\Windows\ShellExt\smss.exe e0b3988dfef3c8f947f2e2287ef00273_JaffaCakes118.exe File opened for modification C:\Windows\drivers\services.exe e0b3988dfef3c8f947f2e2287ef00273_JaffaCakes118.exe File opened for modification C:\Windows\dllcache\services.exe e0b3988dfef3c8f947f2e2287ef00273_JaffaCakes118.exe File opened for modification C:\Windows\spools\smss.exe e0b3988dfef3c8f947f2e2287ef00273_JaffaCakes118.exe File opened for modification C:\Windows\ARTemp.dll e0b3988dfef3c8f947f2e2287ef00273_JaffaCakes118.exe File opened for modification C:\Windows\dll\services.exe e0b3988dfef3c8f947f2e2287ef00273_JaffaCakes118.exe File opened for modification C:\Windows\display\smss.exe e0b3988dfef3c8f947f2e2287ef00273_JaffaCakes118.exe File opened for modification C:\Windows\spools\services.exe e0b3988dfef3c8f947f2e2287ef00273_JaffaCakes118.exe File opened for modification C:\Windows\MsDtc\services.exe e0b3988dfef3c8f947f2e2287ef00273_JaffaCakes118.exe File opened for modification C:\Windows\msapps\services.exe e0b3988dfef3c8f947f2e2287ef00273_JaffaCakes118.exe File opened for modification C:\Windows\AR.dll e0b3988dfef3c8f947f2e2287ef00273_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e0b3988dfef3c8f947f2e2287ef00273_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3984 e0b3988dfef3c8f947f2e2287ef00273_JaffaCakes118.exe -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "0" e0b3988dfef3c8f947f2e2287ef00273_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e0b3988dfef3c8f947f2e2287ef00273_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e0b3988dfef3c8f947f2e2287ef00273_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:3984