Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
29-09-2024 23:51
Static task
static1
Behavioral task
behavioral1
Sample
ff86be0847452874121d6e19d5d300d5_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ff86be0847452874121d6e19d5d300d5_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
ff86be0847452874121d6e19d5d300d5_JaffaCakes118.exe
-
Size
190KB
-
MD5
ff86be0847452874121d6e19d5d300d5
-
SHA1
fc7ca5c1dc9e430bc11ae1a48e2e64258d83bb4d
-
SHA256
e339dbe533c1a513a587f7530c821d2578a2fc9b8d1871bb958ee533267ceecf
-
SHA512
d8fc3ec9568025fa7ca1b6c89255015c87e5dd16cca0da7ea3f8c68fadb88e4329c3e7a69adc35109d17b2c51406ce72d7f184fbdb66d302ca4a9e2f62360305
-
SSDEEP
3072:nGyavt1Giv9QQ60BMaNp11b6GWeO+WOQYM2ZqrhemlKjzHl/16MZS4eD:nfaLGimaMaNrgjeO+WODEhemlKXlfZHe
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2032 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2500 KB00001938.exe -
Loads dropped DLL 2 IoCs
pid Process 2008 ff86be0847452874121d6e19d5d300d5_JaffaCakes118.exe 2008 ff86be0847452874121d6e19d5d300d5_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\KB00001938.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\KB00001938.exe\"" ff86be0847452874121d6e19d5d300d5_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ff86be0847452874121d6e19d5d300d5_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2500 KB00001938.exe 2500 KB00001938.exe 2500 KB00001938.exe 2500 KB00001938.exe 2500 KB00001938.exe 2500 KB00001938.exe 2500 KB00001938.exe 2500 KB00001938.exe 2500 KB00001938.exe 2500 KB00001938.exe 2500 KB00001938.exe 2500 KB00001938.exe 2500 KB00001938.exe 2500 KB00001938.exe 2500 KB00001938.exe 2500 KB00001938.exe 2500 KB00001938.exe 2500 KB00001938.exe 2500 KB00001938.exe 2500 KB00001938.exe 2500 KB00001938.exe 2500 KB00001938.exe 2500 KB00001938.exe 2500 KB00001938.exe 2500 KB00001938.exe 2500 KB00001938.exe 2500 KB00001938.exe 2500 KB00001938.exe 2500 KB00001938.exe 2500 KB00001938.exe 2500 KB00001938.exe 2500 KB00001938.exe 2500 KB00001938.exe 2500 KB00001938.exe 2500 KB00001938.exe 2500 KB00001938.exe 2500 KB00001938.exe 2500 KB00001938.exe 2500 KB00001938.exe 2500 KB00001938.exe 2500 KB00001938.exe 2500 KB00001938.exe 2500 KB00001938.exe 2500 KB00001938.exe 2500 KB00001938.exe 2500 KB00001938.exe 2500 KB00001938.exe 2500 KB00001938.exe 2500 KB00001938.exe 2500 KB00001938.exe 2500 KB00001938.exe 2500 KB00001938.exe 2500 KB00001938.exe 2500 KB00001938.exe 2500 KB00001938.exe 2500 KB00001938.exe 2500 KB00001938.exe 2500 KB00001938.exe 2500 KB00001938.exe 2500 KB00001938.exe 2500 KB00001938.exe 2500 KB00001938.exe 2500 KB00001938.exe 2500 KB00001938.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2500 KB00001938.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 2008 wrote to memory of 2500 2008 ff86be0847452874121d6e19d5d300d5_JaffaCakes118.exe 30 PID 2008 wrote to memory of 2500 2008 ff86be0847452874121d6e19d5d300d5_JaffaCakes118.exe 30 PID 2008 wrote to memory of 2500 2008 ff86be0847452874121d6e19d5d300d5_JaffaCakes118.exe 30 PID 2008 wrote to memory of 2500 2008 ff86be0847452874121d6e19d5d300d5_JaffaCakes118.exe 30 PID 2008 wrote to memory of 2032 2008 ff86be0847452874121d6e19d5d300d5_JaffaCakes118.exe 31 PID 2008 wrote to memory of 2032 2008 ff86be0847452874121d6e19d5d300d5_JaffaCakes118.exe 31 PID 2008 wrote to memory of 2032 2008 ff86be0847452874121d6e19d5d300d5_JaffaCakes118.exe 31 PID 2008 wrote to memory of 2032 2008 ff86be0847452874121d6e19d5d300d5_JaffaCakes118.exe 31 PID 2500 wrote to memory of 1104 2500 KB00001938.exe 19 PID 2500 wrote to memory of 1104 2500 KB00001938.exe 19 PID 2500 wrote to memory of 1104 2500 KB00001938.exe 19 PID 2500 wrote to memory of 1104 2500 KB00001938.exe 19 PID 2500 wrote to memory of 1104 2500 KB00001938.exe 19 PID 2500 wrote to memory of 1168 2500 KB00001938.exe 20 PID 2500 wrote to memory of 1168 2500 KB00001938.exe 20 PID 2500 wrote to memory of 1168 2500 KB00001938.exe 20 PID 2500 wrote to memory of 1168 2500 KB00001938.exe 20 PID 2500 wrote to memory of 1168 2500 KB00001938.exe 20 PID 2500 wrote to memory of 1212 2500 KB00001938.exe 21 PID 2500 wrote to memory of 1212 2500 KB00001938.exe 21 PID 2500 wrote to memory of 1212 2500 KB00001938.exe 21 PID 2500 wrote to memory of 1212 2500 KB00001938.exe 21 PID 2500 wrote to memory of 1212 2500 KB00001938.exe 21 PID 2500 wrote to memory of 1260 2500 KB00001938.exe 23 PID 2500 wrote to memory of 1260 2500 KB00001938.exe 23 PID 2500 wrote to memory of 1260 2500 KB00001938.exe 23 PID 2500 wrote to memory of 1260 2500 KB00001938.exe 23 PID 2500 wrote to memory of 1260 2500 KB00001938.exe 23 PID 2500 wrote to memory of 2032 2500 KB00001938.exe 31 PID 2500 wrote to memory of 2032 2500 KB00001938.exe 31 PID 2500 wrote to memory of 2032 2500 KB00001938.exe 31 PID 2500 wrote to memory of 2032 2500 KB00001938.exe 31 PID 2500 wrote to memory of 2032 2500 KB00001938.exe 31 PID 2500 wrote to memory of 1096 2500 KB00001938.exe 33 PID 2500 wrote to memory of 1096 2500 KB00001938.exe 33 PID 2500 wrote to memory of 1096 2500 KB00001938.exe 33 PID 2500 wrote to memory of 1096 2500 KB00001938.exe 33 PID 2500 wrote to memory of 1096 2500 KB00001938.exe 33
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1104
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1168
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\ff86be0847452874121d6e19d5d300d5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ff86be0847452874121d6e19d5d300d5_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Roaming\KB00001938.exe"C:\Users\Admin\AppData\Roaming\KB00001938.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2500
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\POSA8AE.tmp.BAT"3⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2032
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1260
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵PID:1096
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
286B
MD51270bbdabf506b1049084d62d89a8840
SHA198d75b8c535a9440b04af2938a4d409923f8499f
SHA256b450f0c07a3f082af93cc2e467ce8db4c73665c92d0279e1a20164a3a887b186
SHA512b5ac06472cc4520dedb0dc40ce9992310c20385c0c8e61d78b64ef0e6a85e63436961753ea58bb6f581a259e880384d028846e47158aa4e9272a2e3c85c8fdb7
-
Filesize
190KB
MD5ff86be0847452874121d6e19d5d300d5
SHA1fc7ca5c1dc9e430bc11ae1a48e2e64258d83bb4d
SHA256e339dbe533c1a513a587f7530c821d2578a2fc9b8d1871bb958ee533267ceecf
SHA512d8fc3ec9568025fa7ca1b6c89255015c87e5dd16cca0da7ea3f8c68fadb88e4329c3e7a69adc35109d17b2c51406ce72d7f184fbdb66d302ca4a9e2f62360305