Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
30/09/2024, 20:12
Behavioral task
behavioral1
Sample
0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
150 seconds
General
-
Target
0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe
-
Size
491KB
-
MD5
0318050dc1f2db4decb1c35ff14c9f20
-
SHA1
9cd145edf40dc7103a62d7ea37eb48c742b87c78
-
SHA256
dc182c05f3d1b2710d167128eaffa5ff77764bdd359524947fe874826a8bd637
-
SHA512
ce8515d2b7a01877cb5d9734eaad561acf12e4f433e1e0d2c47f8d263adf0603a1c1e4f9b0f2d0725e588b2f5aa8339c1302fb8622ab76053ee34790361f7aca
-
SSDEEP
6144:aS6vcuW4uS/r8I69xfskGcIUuwdqIeoQzJPyJssJ4R/kM4fdFN5/UAPeXcFcU13U:aob4uhB9NsknLSHlQ3T5sAPGM1FTdTc
Malware Config
Signatures
-
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\WINDOWS\SysWOW64\taskmar.exe 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe File opened for modification C:\WINDOWS\SysWOW64\taskmar.exe 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe -
resource yara_rule behavioral2/memory/2304-0-0x0000000000400000-0x000000000051F000-memory.dmp upx behavioral2/memory/2304-17-0x0000000000400000-0x000000000051F000-memory.dmp upx behavioral2/memory/2304-18-0x0000000000400000-0x000000000051F000-memory.dmp upx behavioral2/memory/2304-22-0x0000000000400000-0x000000000051F000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe -
Kills process with taskkill 3 IoCs
pid Process 3224 taskkill.exe 396 taskkill.exe 1920 taskkill.exe -
Modifies registry class 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefiles\DefaultIcon\ = "%1" 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefiles\shell\open\command 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefiles\shell 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefiles\shell\open 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefiles\shell\open\command\ = "\"C:\\WINDOWS\\system32\\taskmar.exe\" \"%1\"" 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.exe\ = "exefiles" 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefiles\DefaultIcon 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefiles 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: 33 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe Token: 33 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe Token: 33 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe Token: 33 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe Token: 33 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe Token: 33 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe Token: 33 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe Token: 33 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe Token: 33 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe Token: 33 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe Token: 33 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe Token: 33 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe Token: 33 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe Token: 33 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe Token: 33 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe Token: 33 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe Token: 33 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe Token: 33 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe Token: 33 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe Token: 33 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe Token: 33 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe Token: 33 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe Token: 33 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe Token: 33 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe Token: 33 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe Token: 33 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe Token: 33 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe Token: 33 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe Token: 33 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe Token: 33 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe Token: 33 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe Token: 33 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2304 wrote to memory of 3224 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe 82 PID 2304 wrote to memory of 3224 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe 82 PID 2304 wrote to memory of 3224 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe 82 PID 2304 wrote to memory of 396 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe 88 PID 2304 wrote to memory of 396 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe 88 PID 2304 wrote to memory of 396 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe 88 PID 2304 wrote to memory of 3740 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe 90 PID 2304 wrote to memory of 3740 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe 90 PID 2304 wrote to memory of 3740 2304 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe 90 PID 3740 wrote to memory of 1920 3740 cmd.exe 92 PID 3740 wrote to memory of 1920 3740 cmd.exe 92 PID 3740 wrote to memory of 1920 3740 cmd.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im ZhuDongFangYu.exe /t2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:3224
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im QQ.exe /t2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:396
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\0.bat2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe /t3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:1920
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
281B
MD5957c2367bd1fd1e56c5bacbb4a059bf6
SHA15dd116b0913a7214f42c215a55056c0812a020c7
SHA256e618125efefd60ff6f7c5b60f08ccbf36b51e3b772e5caf762afb2a66a5d1e8c
SHA5123d8c926717c9c415fabf38b37324140675c084ad3891c840b841f7671b6ad915a01fb73b4e05c00f68fbf53530b4c523030c189fb040c30120ffe7863d1232a4
-
Filesize
164KB
MD5fc16b42489f4cfd99a6e1c07f5c810f6
SHA176e8615e467b5fb1fb15f6d5a429cae437fdac95
SHA256084a2530021858a57561c09bfe7fa18a26555b14893cc40ee42970b3c07e75ef
SHA512caee88860e772af113e90b14e159a81d6b431fdaad6fff4a89e7fcda6ed49b1780059d8180a26292cda1a675e24f1d33fc20a604a926077374da168b9f72a421
