Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25/09/2024, 08:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exe
-
Size
124KB
-
MD5
f59f199740185896b3c54ddf2ace6704
-
SHA1
0d1416738f398fe60ff2e68d4c3a620823ce3f9d
-
SHA256
442450bd008400a6867d0560c22ba883206754a7e9e996f582615a21b43bd09f
-
SHA512
a7176b8bde8254bf41cda07ca5c4fcbd2e176f7a8e28894f024c3e2d0be234410b0f12c51ca9630bd9f58a772ffbd5794e747cdf2a0dd7feaf6d8c6be9818fc7
-
SSDEEP
1536:M2kwGMG6qaM0+O3pcF2uZ3Pmcsm4jFQ+rLH3V7OvQT1gJnVMKK1P:M2UMG/avpl23/EJzfH3VCe8HKB
Score
6/10
Malware Config
Signatures
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\nu f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2500 set thread context of 2680 2500 f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exe 31 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2680 f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2500 f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2500 wrote to memory of 2680 2500 f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exe 31 PID 2500 wrote to memory of 2680 2500 f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exe 31 PID 2500 wrote to memory of 2680 2500 f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exe 31 PID 2500 wrote to memory of 2680 2500 f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exe 31 PID 2500 wrote to memory of 2680 2500 f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exe 31 PID 2500 wrote to memory of 2680 2500 f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exe 31 PID 2500 wrote to memory of 2680 2500 f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exe 31 PID 2500 wrote to memory of 2680 2500 f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exe 31 PID 2500 wrote to memory of 2680 2500 f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exe 31 PID 2680 wrote to memory of 1392 2680 f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exe 21 PID 2680 wrote to memory of 1392 2680 f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exe 21 PID 2680 wrote to memory of 1392 2680 f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exe 21 PID 2680 wrote to memory of 1392 2680 f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exe 21 PID 2680 wrote to memory of 1392 2680 f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exe 21 PID 2680 wrote to memory of 1392 2680 f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exe 21 PID 2680 wrote to memory of 1392 2680 f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exe 21 PID 2680 wrote to memory of 1392 2680 f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exe 21 PID 2680 wrote to memory of 1392 2680 f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exe 21 PID 2680 wrote to memory of 1392 2680 f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exe 21 PID 2680 wrote to memory of 1392 2680 f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exe 21 PID 2680 wrote to memory of 1392 2680 f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exe 21 PID 2680 wrote to memory of 1392 2680 f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exe 21 PID 2680 wrote to memory of 1392 2680 f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exe 21 PID 2680 wrote to memory of 1392 2680 f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exe 21 PID 2680 wrote to memory of 1392 2680 f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exe 21 PID 2680 wrote to memory of 1392 2680 f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exe 21 PID 2680 wrote to memory of 1392 2680 f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exe 21 PID 2680 wrote to memory of 1392 2680 f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exe 21 PID 2680 wrote to memory of 1392 2680 f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exe 21 PID 2680 wrote to memory of 1392 2680 f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exe 21 PID 2680 wrote to memory of 1392 2680 f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exe 21 PID 2680 wrote to memory of 1392 2680 f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exe 21 PID 2680 wrote to memory of 1392 2680 f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exe 21 PID 2680 wrote to memory of 1392 2680 f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exe 21 PID 2680 wrote to memory of 1392 2680 f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exe 21 PID 2680 wrote to memory of 1392 2680 f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exe 21 PID 2680 wrote to memory of 1392 2680 f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exe 21 PID 2680 wrote to memory of 1392 2680 f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exe 21 PID 2680 wrote to memory of 1392 2680 f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exe 21 PID 2680 wrote to memory of 1392 2680 f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exe 21 PID 2680 wrote to memory of 1392 2680 f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exe 21 PID 2680 wrote to memory of 1392 2680 f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exe 21 PID 2680 wrote to memory of 1392 2680 f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exe 21 PID 2680 wrote to memory of 1392 2680 f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exe 21 PID 2680 wrote to memory of 1392 2680 f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exe 21 PID 2680 wrote to memory of 1392 2680 f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exe 21 PID 2680 wrote to memory of 1392 2680 f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exe 21 PID 2680 wrote to memory of 1392 2680 f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exe 21 PID 2680 wrote to memory of 1392 2680 f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exe 21 PID 2680 wrote to memory of 1392 2680 f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exe 21 PID 2680 wrote to memory of 1392 2680 f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exe 21 PID 2680 wrote to memory of 1392 2680 f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exe 21 PID 2680 wrote to memory of 1392 2680 f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exe 21 PID 2680 wrote to memory of 1392 2680 f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exe 21 PID 2680 wrote to memory of 1392 2680 f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exe 21 PID 2680 wrote to memory of 1392 2680 f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exe 21 PID 2680 wrote to memory of 1392 2680 f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exe 21 PID 2680 wrote to memory of 1392 2680 f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exe 21 PID 2680 wrote to memory of 1392 2680 f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exe 21 PID 2680 wrote to memory of 1392 2680 f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exe 21 PID 2680 wrote to memory of 1392 2680 f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exe 21 PID 2680 wrote to memory of 1392 2680 f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exe 21 PID 2680 wrote to memory of 1392 2680 f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exe 21 PID 2680 wrote to memory of 1392 2680 f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exe 21
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exe"2⤵
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f59f199740185896b3c54ddf2ace6704_JaffaCakes118.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2680
-
-