Analysis
- max time kernel
149s - max time network
94s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
20/09/2024, 21:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe
- Size 435KB
- Sample240920-1rav9azdrf
- SHA256 0799cc5510a0215d3444a0d929af08ddba173bbe31cf7235d5ec259feafd7523
- MD5 ee7e41c3f4b8f88383418cdfa26cb353
- SHA1 72393c9ce46cc9e724996aee4510e61e5a55e55d
- SHA512 34c7ac56baf84c153822580a74acf21e547c529417b65df90cd729d525a00adb8da0a91377226569f5de328741a74f133ba26757375a8d9bea05e5d78a226a1e
- SSDEEP 6144:8LiUiZb244JoBvtWcHTSvjQh01f+RuVWKs67Q6NP/ai7o0KGV88T6W7:8LiUk4JofEfU6E6NPyn0KGVhJ
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "0" ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe - Disables Task Manager via registry modification
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AgataSoft ShutDown Pro = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe" ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1740 ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ee7e41c3f4b8f88383418cdfa26cb353_JaffaCakes118.exe"1⤵
- Disables RegEdit via registry modification
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1740