Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-09-2024 23:50
Behavioral task
behavioral1
Sample
ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe
-
Size
56KB
-
MD5
ec6ca99af8372e9e0aac3554e5a5ea66
-
SHA1
e2308f5ee966218ebca095ff08a496f8c50ca523
-
SHA256
6d59f5b6bed43804ea372c82ab89bef56f7da0a4cd4d710c9bc24a61b020cfff
-
SHA512
ff52449480f82c05ab160ccc242aa8f466e152a87f0886bb19adc8872b00bc28733676f252af459dc4675b5c6a35d7c917c79f6b38335bec9c953ca7685d82d2
-
SSDEEP
1536:wet+aF08bJKazAy4Y7wxpU41o3eqOlAh:8U0gzAy4Yk7q3eH0
Score
6/10
Malware Config
Signatures
-
Drops file in System32 directory 6 IoCs
description ioc Process File created C:\Windows\SysWOW64\tpnc.bat ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\wpcap.dll ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\À]ü’ÏTËþÕðÿTµê6 ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\wpcap.dla&Þ(" ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\wpcap.dl*ÅÑŒ-bOâ ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe File created C:\Windows\SysWOW64\atielf.dat ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2332 ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe 2332 ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe 2332 ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe 2332 ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe 2332 ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe 2332 ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe 2332 ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe 2332 ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe 2332 ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe 2332 ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe 2332 ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe 2332 ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe 2332 ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe 2332 ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe 2332 ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe 2332 ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe 2332 ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe 2332 ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe 2332 ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe 2332 ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe 2332 ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe 2332 ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe 2332 ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe 2332 ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe 2332 ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe 2332 ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe 2332 ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe 2332 ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe 2332 ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe 2332 ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe 2332 ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe 2332 ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe 2332 ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe 2332 ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe 2332 ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe 2332 ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe 2332 ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe 2332 ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe 2332 ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe 2332 ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe 2332 ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe 2332 ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe 2332 ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe 2332 ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe 2332 ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe 2332 ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe 2332 ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe 2332 ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe 2332 ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe 2332 ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe 2332 ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe 2332 ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe 2332 ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe 2332 ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe 2332 ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe 2332 ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe 2332 ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe 2332 ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe 2332 ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe 2332 ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe 2332 ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe 2332 ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe 2332 ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe 2332 ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 476 Process not Found -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeRestorePrivilege 2332 ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2332 wrote to memory of 1956 2332 ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe 30 PID 2332 wrote to memory of 1956 2332 ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe 30 PID 2332 wrote to memory of 1956 2332 ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe 30 PID 2332 wrote to memory of 1956 2332 ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe 30 PID 1956 wrote to memory of 2304 1956 cmd.exe 32 PID 1956 wrote to memory of 2304 1956 cmd.exe 32 PID 1956 wrote to memory of 2304 1956 cmd.exe 32 PID 1956 wrote to memory of 2304 1956 cmd.exe 32 PID 2304 wrote to memory of 2444 2304 net.exe 33 PID 2304 wrote to memory of 2444 2304 net.exe 33 PID 2304 wrote to memory of 2444 2304 net.exe 33 PID 2304 wrote to memory of 2444 2304 net.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\system32\tpnc.bat2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Windows\SysWOW64\net.exenet stop sharedaccess3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess4⤵
- System Location Discovery: System Language Discovery
PID:2444
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
21B
MD57b16cc4ebd5af5d255eeb8a7b487875b
SHA13f679d76efb21f7b2249ddc2a0d8a68d71220d16
SHA2565040cfcc7def4d52830218981dc6cb729abe9eb3b1a38d8df5c56698336098b1
SHA5127f16419eddc8cedb0e133fe482a958cf6997b8b30456a3f3949066e9279fef888e1297065850f77bdae189a5d93e6bc69eb6e33d73ef1e0d64642f2fb2ff61d0