Analysis
-
max time kernel
133s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
21-09-2024 22:40
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
f0c1470334ecb7dd85e4a3dac7156fdd_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
f0c1470334ecb7dd85e4a3dac7156fdd_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/D1958.dll
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/D1958.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/setup1.exe
Resource
win7-20240708-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/setup1.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
General
-
Target
f0c1470334ecb7dd85e4a3dac7156fdd_JaffaCakes118.exe
-
Size
589KB
-
MD5
f0c1470334ecb7dd85e4a3dac7156fdd
-
SHA1
62bc283d421699c815b761c4c261d359e02dda11
-
SHA256
0502c25cdf49f30858297c60e3a42ddbdc09e0b3a03aa14799407ea6f7d79f37
-
SHA512
0381980226db9b231415949884cf0e77a15b0b174e68f39af542f8d82082037695dd22a9b0bbd5ae8d136908f585ce2060d1f8edca0a0bb86f3fb5d840ae0a04
-
SSDEEP
12288:S2KvgHgC2970kAMHJmhxI7w7vEBPsRuvEH2ZVLRvRpnQOEP1/:S2KYA777A1he2vCyWDlrQP1
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 528 setup.exe -
Loads dropped DLL 1 IoCs
pid Process 3392 f0c1470334ecb7dd85e4a3dac7156fdd_JaffaCakes118.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMIC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMIC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMIC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f0c1470334ecb7dd85e4a3dac7156fdd_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMIC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMIC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMIC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 528 setup.exe 528 setup.exe 528 setup.exe 528 setup.exe 528 setup.exe 528 setup.exe 528 setup.exe 528 setup.exe 528 setup.exe 528 setup.exe 528 setup.exe 528 setup.exe 528 setup.exe 528 setup.exe 528 setup.exe 528 setup.exe 528 setup.exe 528 setup.exe 528 setup.exe 528 setup.exe 528 setup.exe 528 setup.exe 528 setup.exe 528 setup.exe 528 setup.exe 528 setup.exe 528 setup.exe 528 setup.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 636 WMIC.exe Token: SeSecurityPrivilege 636 WMIC.exe Token: SeTakeOwnershipPrivilege 636 WMIC.exe Token: SeLoadDriverPrivilege 636 WMIC.exe Token: SeSystemProfilePrivilege 636 WMIC.exe Token: SeSystemtimePrivilege 636 WMIC.exe Token: SeProfSingleProcessPrivilege 636 WMIC.exe Token: SeIncBasePriorityPrivilege 636 WMIC.exe Token: SeCreatePagefilePrivilege 636 WMIC.exe Token: SeBackupPrivilege 636 WMIC.exe Token: SeRestorePrivilege 636 WMIC.exe Token: SeShutdownPrivilege 636 WMIC.exe Token: SeDebugPrivilege 636 WMIC.exe Token: SeSystemEnvironmentPrivilege 636 WMIC.exe Token: SeRemoteShutdownPrivilege 636 WMIC.exe Token: SeUndockPrivilege 636 WMIC.exe Token: SeManageVolumePrivilege 636 WMIC.exe Token: 33 636 WMIC.exe Token: 34 636 WMIC.exe Token: 35 636 WMIC.exe Token: 36 636 WMIC.exe Token: SeIncreaseQuotaPrivilege 636 WMIC.exe Token: SeSecurityPrivilege 636 WMIC.exe Token: SeTakeOwnershipPrivilege 636 WMIC.exe Token: SeLoadDriverPrivilege 636 WMIC.exe Token: SeSystemProfilePrivilege 636 WMIC.exe Token: SeSystemtimePrivilege 636 WMIC.exe Token: SeProfSingleProcessPrivilege 636 WMIC.exe Token: SeIncBasePriorityPrivilege 636 WMIC.exe Token: SeCreatePagefilePrivilege 636 WMIC.exe Token: SeBackupPrivilege 636 WMIC.exe Token: SeRestorePrivilege 636 WMIC.exe Token: SeShutdownPrivilege 636 WMIC.exe Token: SeDebugPrivilege 636 WMIC.exe Token: SeSystemEnvironmentPrivilege 636 WMIC.exe Token: SeRemoteShutdownPrivilege 636 WMIC.exe Token: SeUndockPrivilege 636 WMIC.exe Token: SeManageVolumePrivilege 636 WMIC.exe Token: 33 636 WMIC.exe Token: 34 636 WMIC.exe Token: 35 636 WMIC.exe Token: 36 636 WMIC.exe Token: SeIncreaseQuotaPrivilege 3904 WMIC.exe Token: SeSecurityPrivilege 3904 WMIC.exe Token: SeTakeOwnershipPrivilege 3904 WMIC.exe Token: SeLoadDriverPrivilege 3904 WMIC.exe Token: SeSystemProfilePrivilege 3904 WMIC.exe Token: SeSystemtimePrivilege 3904 WMIC.exe Token: SeProfSingleProcessPrivilege 3904 WMIC.exe Token: SeIncBasePriorityPrivilege 3904 WMIC.exe Token: SeCreatePagefilePrivilege 3904 WMIC.exe Token: SeBackupPrivilege 3904 WMIC.exe Token: SeRestorePrivilege 3904 WMIC.exe Token: SeShutdownPrivilege 3904 WMIC.exe Token: SeDebugPrivilege 3904 WMIC.exe Token: SeSystemEnvironmentPrivilege 3904 WMIC.exe Token: SeRemoteShutdownPrivilege 3904 WMIC.exe Token: SeUndockPrivilege 3904 WMIC.exe Token: SeManageVolumePrivilege 3904 WMIC.exe Token: 33 3904 WMIC.exe Token: 34 3904 WMIC.exe Token: 35 3904 WMIC.exe Token: 36 3904 WMIC.exe Token: SeIncreaseQuotaPrivilege 3904 WMIC.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 528 setup.exe 528 setup.exe -
Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 3392 wrote to memory of 528 3392 f0c1470334ecb7dd85e4a3dac7156fdd_JaffaCakes118.exe 82 PID 3392 wrote to memory of 528 3392 f0c1470334ecb7dd85e4a3dac7156fdd_JaffaCakes118.exe 82 PID 3392 wrote to memory of 528 3392 f0c1470334ecb7dd85e4a3dac7156fdd_JaffaCakes118.exe 82 PID 528 wrote to memory of 4336 528 setup.exe 92 PID 528 wrote to memory of 4336 528 setup.exe 92 PID 528 wrote to memory of 4336 528 setup.exe 92 PID 4336 wrote to memory of 636 4336 cmd.exe 94 PID 4336 wrote to memory of 636 4336 cmd.exe 94 PID 4336 wrote to memory of 636 4336 cmd.exe 94 PID 528 wrote to memory of 4160 528 setup.exe 95 PID 528 wrote to memory of 4160 528 setup.exe 95 PID 528 wrote to memory of 4160 528 setup.exe 95 PID 4160 wrote to memory of 3904 4160 cmd.exe 97 PID 4160 wrote to memory of 3904 4160 cmd.exe 97 PID 4160 wrote to memory of 3904 4160 cmd.exe 97 PID 528 wrote to memory of 832 528 setup.exe 98 PID 528 wrote to memory of 832 528 setup.exe 98 PID 528 wrote to memory of 832 528 setup.exe 98 PID 832 wrote to memory of 972 832 cmd.exe 100 PID 832 wrote to memory of 972 832 cmd.exe 100 PID 832 wrote to memory of 972 832 cmd.exe 100 PID 528 wrote to memory of 4748 528 setup.exe 101 PID 528 wrote to memory of 4748 528 setup.exe 101 PID 528 wrote to memory of 4748 528 setup.exe 101 PID 4748 wrote to memory of 2004 4748 cmd.exe 103 PID 4748 wrote to memory of 2004 4748 cmd.exe 103 PID 4748 wrote to memory of 2004 4748 cmd.exe 103 PID 528 wrote to memory of 3124 528 setup.exe 104 PID 528 wrote to memory of 3124 528 setup.exe 104 PID 528 wrote to memory of 3124 528 setup.exe 104 PID 3124 wrote to memory of 1608 3124 cmd.exe 106 PID 3124 wrote to memory of 1608 3124 cmd.exe 106 PID 3124 wrote to memory of 1608 3124 cmd.exe 106 PID 528 wrote to memory of 4304 528 setup.exe 107 PID 528 wrote to memory of 4304 528 setup.exe 107 PID 528 wrote to memory of 4304 528 setup.exe 107 PID 4304 wrote to memory of 5060 4304 cmd.exe 109 PID 4304 wrote to memory of 5060 4304 cmd.exe 109 PID 4304 wrote to memory of 5060 4304 cmd.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\f0c1470334ecb7dd85e4a3dac7156fdd_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f0c1470334ecb7dd85e4a3dac7156fdd_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\nsmB1FC.tmp\setup.exe"C:\Users\Admin\AppData\Local\Temp\nsmB1FC.tmp\setup.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:528 -
C:\Windows\SysWOW64\cmd.execmd.exe /c WMIC path win32_process WHERE Processid=3392 get Commandline3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Windows\SysWOW64\Wbem\WMIC.exeWMIC path win32_process WHERE Processid=3392 get Commandline4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:636
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c WMIC path win32_process WHERE Processid=3500 get Commandline3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Windows\SysWOW64\Wbem\WMIC.exeWMIC path win32_process WHERE Processid=3500 get Commandline4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3904
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c WMIC path win32_process WHERE Processid=3460 get Commandline3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Windows\SysWOW64\Wbem\WMIC.exeWMIC path win32_process WHERE Processid=3460 get Commandline4⤵
- System Location Discovery: System Language Discovery
PID:972
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c WMIC path win32_process WHERE Processid=3392 get Commandline3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Windows\SysWOW64\Wbem\WMIC.exeWMIC path win32_process WHERE Processid=3392 get Commandline4⤵
- System Location Discovery: System Language Discovery
PID:2004
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c WMIC path win32_process WHERE Processid=3500 get Commandline3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Windows\SysWOW64\Wbem\WMIC.exeWMIC path win32_process WHERE Processid=3500 get Commandline4⤵
- System Location Discovery: System Language Discovery
PID:1608
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c WMIC path win32_process WHERE Processid=3460 get Commandline3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Windows\SysWOW64\Wbem\WMIC.exeWMIC path win32_process WHERE Processid=3460 get Commandline4⤵
- System Location Discovery: System Language Discovery
PID:5060
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14KB
MD5904beebec2790ee2ca0c90fc448ac7e0
SHA140fabf1eb0a3b7168351c4514c5288216cb1566d
SHA256f730d9385bf72eac5d579bcf1f7e4330f1d239ca1054d4ead48e9e363d9f4222
SHA5128bdbbaaf73e396cf9fd9866b3e824b7e70c59a2bdefdb3236387e60d0e645d011265fe79fb193f6c0d6abe2e9c01260720c71cd8f068fcc4624760511c54efaa
-
Filesize
535KB
MD5e3efada5949c84e407a16674e4932689
SHA1ae44b6551f8982a6217a8cb81bd4ae1d19487bf2
SHA2567b48dc423e5bafbf830c5936170a52b0a6e6a38e56d8cd3063f941245b531d0a
SHA512094260d535fdd0dc19cf6f108317fbf55f7a9d2797cf05d8d7113101d7313ea31a5ecd514afc69a101f60fdf33d9ec1fd2d05d69e7b2238d774ba8c17786b1a9