Analysis
-
max time kernel
134s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21/09/2024, 22:40
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
f0c1470334ecb7dd85e4a3dac7156fdd_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
f0c1470334ecb7dd85e4a3dac7156fdd_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/D1958.dll
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/D1958.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/setup1.exe
Resource
win7-20240708-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/setup1.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
General
-
Target
f0c1470334ecb7dd85e4a3dac7156fdd_JaffaCakes118.exe
-
Size
589KB
-
MD5
f0c1470334ecb7dd85e4a3dac7156fdd
-
SHA1
62bc283d421699c815b761c4c261d359e02dda11
-
SHA256
0502c25cdf49f30858297c60e3a42ddbdc09e0b3a03aa14799407ea6f7d79f37
-
SHA512
0381980226db9b231415949884cf0e77a15b0b174e68f39af542f8d82082037695dd22a9b0bbd5ae8d136908f585ce2060d1f8edca0a0bb86f3fb5d840ae0a04
-
SSDEEP
12288:S2KvgHgC2970kAMHJmhxI7w7vEBPsRuvEH2ZVLRvRpnQOEP1/:S2KYA777A1he2vCyWDlrQP1
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2392 setup.exe -
Loads dropped DLL 2 IoCs
pid Process 2492 f0c1470334ecb7dd85e4a3dac7156fdd_JaffaCakes118.exe 2492 f0c1470334ecb7dd85e4a3dac7156fdd_JaffaCakes118.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMIC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMIC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMIC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMIC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMIC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f0c1470334ecb7dd85e4a3dac7156fdd_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMIC.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main setup.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 2392 setup.exe 2392 setup.exe 2392 setup.exe 2392 setup.exe 2392 setup.exe 2392 setup.exe 2392 setup.exe 2392 setup.exe 2392 setup.exe 2392 setup.exe 2392 setup.exe 2392 setup.exe 2392 setup.exe 2392 setup.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2032 WMIC.exe Token: SeSecurityPrivilege 2032 WMIC.exe Token: SeTakeOwnershipPrivilege 2032 WMIC.exe Token: SeLoadDriverPrivilege 2032 WMIC.exe Token: SeSystemProfilePrivilege 2032 WMIC.exe Token: SeSystemtimePrivilege 2032 WMIC.exe Token: SeProfSingleProcessPrivilege 2032 WMIC.exe Token: SeIncBasePriorityPrivilege 2032 WMIC.exe Token: SeCreatePagefilePrivilege 2032 WMIC.exe Token: SeBackupPrivilege 2032 WMIC.exe Token: SeRestorePrivilege 2032 WMIC.exe Token: SeShutdownPrivilege 2032 WMIC.exe Token: SeDebugPrivilege 2032 WMIC.exe Token: SeSystemEnvironmentPrivilege 2032 WMIC.exe Token: SeRemoteShutdownPrivilege 2032 WMIC.exe Token: SeUndockPrivilege 2032 WMIC.exe Token: SeManageVolumePrivilege 2032 WMIC.exe Token: 33 2032 WMIC.exe Token: 34 2032 WMIC.exe Token: 35 2032 WMIC.exe Token: SeIncreaseQuotaPrivilege 2032 WMIC.exe Token: SeSecurityPrivilege 2032 WMIC.exe Token: SeTakeOwnershipPrivilege 2032 WMIC.exe Token: SeLoadDriverPrivilege 2032 WMIC.exe Token: SeSystemProfilePrivilege 2032 WMIC.exe Token: SeSystemtimePrivilege 2032 WMIC.exe Token: SeProfSingleProcessPrivilege 2032 WMIC.exe Token: SeIncBasePriorityPrivilege 2032 WMIC.exe Token: SeCreatePagefilePrivilege 2032 WMIC.exe Token: SeBackupPrivilege 2032 WMIC.exe Token: SeRestorePrivilege 2032 WMIC.exe Token: SeShutdownPrivilege 2032 WMIC.exe Token: SeDebugPrivilege 2032 WMIC.exe Token: SeSystemEnvironmentPrivilege 2032 WMIC.exe Token: SeRemoteShutdownPrivilege 2032 WMIC.exe Token: SeUndockPrivilege 2032 WMIC.exe Token: SeManageVolumePrivilege 2032 WMIC.exe Token: 33 2032 WMIC.exe Token: 34 2032 WMIC.exe Token: 35 2032 WMIC.exe Token: SeIncreaseQuotaPrivilege 352 WMIC.exe Token: SeSecurityPrivilege 352 WMIC.exe Token: SeTakeOwnershipPrivilege 352 WMIC.exe Token: SeLoadDriverPrivilege 352 WMIC.exe Token: SeSystemProfilePrivilege 352 WMIC.exe Token: SeSystemtimePrivilege 352 WMIC.exe Token: SeProfSingleProcessPrivilege 352 WMIC.exe Token: SeIncBasePriorityPrivilege 352 WMIC.exe Token: SeCreatePagefilePrivilege 352 WMIC.exe Token: SeBackupPrivilege 352 WMIC.exe Token: SeRestorePrivilege 352 WMIC.exe Token: SeShutdownPrivilege 352 WMIC.exe Token: SeDebugPrivilege 352 WMIC.exe Token: SeSystemEnvironmentPrivilege 352 WMIC.exe Token: SeRemoteShutdownPrivilege 352 WMIC.exe Token: SeUndockPrivilege 352 WMIC.exe Token: SeManageVolumePrivilege 352 WMIC.exe Token: 33 352 WMIC.exe Token: 34 352 WMIC.exe Token: 35 352 WMIC.exe Token: SeIncreaseQuotaPrivilege 352 WMIC.exe Token: SeSecurityPrivilege 352 WMIC.exe Token: SeTakeOwnershipPrivilege 352 WMIC.exe Token: SeLoadDriverPrivilege 352 WMIC.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2392 setup.exe 2392 setup.exe -
Suspicious use of WriteProcessMemory 55 IoCs
description pid Process procid_target PID 2492 wrote to memory of 2392 2492 f0c1470334ecb7dd85e4a3dac7156fdd_JaffaCakes118.exe 30 PID 2492 wrote to memory of 2392 2492 f0c1470334ecb7dd85e4a3dac7156fdd_JaffaCakes118.exe 30 PID 2492 wrote to memory of 2392 2492 f0c1470334ecb7dd85e4a3dac7156fdd_JaffaCakes118.exe 30 PID 2492 wrote to memory of 2392 2492 f0c1470334ecb7dd85e4a3dac7156fdd_JaffaCakes118.exe 30 PID 2492 wrote to memory of 2392 2492 f0c1470334ecb7dd85e4a3dac7156fdd_JaffaCakes118.exe 30 PID 2492 wrote to memory of 2392 2492 f0c1470334ecb7dd85e4a3dac7156fdd_JaffaCakes118.exe 30 PID 2492 wrote to memory of 2392 2492 f0c1470334ecb7dd85e4a3dac7156fdd_JaffaCakes118.exe 30 PID 2392 wrote to memory of 2000 2392 setup.exe 33 PID 2392 wrote to memory of 2000 2392 setup.exe 33 PID 2392 wrote to memory of 2000 2392 setup.exe 33 PID 2392 wrote to memory of 2000 2392 setup.exe 33 PID 2000 wrote to memory of 2032 2000 cmd.exe 35 PID 2000 wrote to memory of 2032 2000 cmd.exe 35 PID 2000 wrote to memory of 2032 2000 cmd.exe 35 PID 2000 wrote to memory of 2032 2000 cmd.exe 35 PID 2392 wrote to memory of 1396 2392 setup.exe 37 PID 2392 wrote to memory of 1396 2392 setup.exe 37 PID 2392 wrote to memory of 1396 2392 setup.exe 37 PID 2392 wrote to memory of 1396 2392 setup.exe 37 PID 1396 wrote to memory of 352 1396 cmd.exe 39 PID 1396 wrote to memory of 352 1396 cmd.exe 39 PID 1396 wrote to memory of 352 1396 cmd.exe 39 PID 1396 wrote to memory of 352 1396 cmd.exe 39 PID 2392 wrote to memory of 1912 2392 setup.exe 40 PID 2392 wrote to memory of 1912 2392 setup.exe 40 PID 2392 wrote to memory of 1912 2392 setup.exe 40 PID 2392 wrote to memory of 1912 2392 setup.exe 40 PID 1912 wrote to memory of 1876 1912 cmd.exe 42 PID 1912 wrote to memory of 1876 1912 cmd.exe 42 PID 1912 wrote to memory of 1876 1912 cmd.exe 42 PID 1912 wrote to memory of 1876 1912 cmd.exe 42 PID 2392 wrote to memory of 1916 2392 setup.exe 44 PID 2392 wrote to memory of 1916 2392 setup.exe 44 PID 2392 wrote to memory of 1916 2392 setup.exe 44 PID 2392 wrote to memory of 1916 2392 setup.exe 44 PID 1916 wrote to memory of 3064 1916 cmd.exe 46 PID 1916 wrote to memory of 3064 1916 cmd.exe 46 PID 1916 wrote to memory of 3064 1916 cmd.exe 46 PID 1916 wrote to memory of 3064 1916 cmd.exe 46 PID 2392 wrote to memory of 2236 2392 setup.exe 47 PID 2392 wrote to memory of 2236 2392 setup.exe 47 PID 2392 wrote to memory of 2236 2392 setup.exe 47 PID 2392 wrote to memory of 2236 2392 setup.exe 47 PID 2236 wrote to memory of 2556 2236 cmd.exe 49 PID 2236 wrote to memory of 2556 2236 cmd.exe 49 PID 2236 wrote to memory of 2556 2236 cmd.exe 49 PID 2236 wrote to memory of 2556 2236 cmd.exe 49 PID 2392 wrote to memory of 2936 2392 setup.exe 50 PID 2392 wrote to memory of 2936 2392 setup.exe 50 PID 2392 wrote to memory of 2936 2392 setup.exe 50 PID 2392 wrote to memory of 2936 2392 setup.exe 50 PID 2936 wrote to memory of 1500 2936 cmd.exe 52 PID 2936 wrote to memory of 1500 2936 cmd.exe 52 PID 2936 wrote to memory of 1500 2936 cmd.exe 52 PID 2936 wrote to memory of 1500 2936 cmd.exe 52
Processes
-
C:\Users\Admin\AppData\Local\Temp\f0c1470334ecb7dd85e4a3dac7156fdd_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f0c1470334ecb7dd85e4a3dac7156fdd_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\nsdA343.tmp\setup.exe"C:\Users\Admin\AppData\Local\Temp\nsdA343.tmp\setup.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Windows\SysWOW64\cmd.execmd.exe /c WMIC path win32_process WHERE Processid=2492 get Commandline3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Windows\SysWOW64\Wbem\WMIC.exeWMIC path win32_process WHERE Processid=2492 get Commandline4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2032
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c WMIC path win32_process WHERE Processid=1112 get Commandline3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Windows\SysWOW64\Wbem\WMIC.exeWMIC path win32_process WHERE Processid=1112 get Commandline4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:352
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c WMIC path win32_process WHERE Processid=280 get Commandline3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Windows\SysWOW64\Wbem\WMIC.exeWMIC path win32_process WHERE Processid=280 get Commandline4⤵
- System Location Discovery: System Language Discovery
PID:1876
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c WMIC path win32_process WHERE Processid=2492 get Commandline3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Windows\SysWOW64\Wbem\WMIC.exeWMIC path win32_process WHERE Processid=2492 get Commandline4⤵
- System Location Discovery: System Language Discovery
PID:3064
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c WMIC path win32_process WHERE Processid=1112 get Commandline3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Windows\SysWOW64\Wbem\WMIC.exeWMIC path win32_process WHERE Processid=1112 get Commandline4⤵
- System Location Discovery: System Language Discovery
PID:2556
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c WMIC path win32_process WHERE Processid=280 get Commandline3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Windows\SysWOW64\Wbem\WMIC.exeWMIC path win32_process WHERE Processid=280 get Commandline4⤵
- System Location Discovery: System Language Discovery
PID:1500
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14KB
MD5904beebec2790ee2ca0c90fc448ac7e0
SHA140fabf1eb0a3b7168351c4514c5288216cb1566d
SHA256f730d9385bf72eac5d579bcf1f7e4330f1d239ca1054d4ead48e9e363d9f4222
SHA5128bdbbaaf73e396cf9fd9866b3e824b7e70c59a2bdefdb3236387e60d0e645d011265fe79fb193f6c0d6abe2e9c01260720c71cd8f068fcc4624760511c54efaa
-
Filesize
535KB
MD5e3efada5949c84e407a16674e4932689
SHA1ae44b6551f8982a6217a8cb81bd4ae1d19487bf2
SHA2567b48dc423e5bafbf830c5936170a52b0a6e6a38e56d8cd3063f941245b531d0a
SHA512094260d535fdd0dc19cf6f108317fbf55f7a9d2797cf05d8d7113101d7313ea31a5ecd514afc69a101f60fdf33d9ec1fd2d05d69e7b2238d774ba8c17786b1a9