Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
03/10/2024, 23:05
Behavioral task
behavioral1
Sample
10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe
-
Size
26KB
-
MD5
10d767565d4d02ef2ac8531e941d1a87
-
SHA1
a9511ce2cb13709d1841fe3d6376a5bd07ed02d9
-
SHA256
5da5fc7b32581c8b320df7b80b3e518a59b8f8f9ebc57509ff8b31628bb7904c
-
SHA512
9a71af7e43705ac16a928f49b3438c5cb078cbc180c3333f3fa2d67299271a1a6af5a3c7c6082d3374d74f8eb900b7e90d585c690bd7c1a941fb82d51b14c4db
-
SSDEEP
768:Z8w+5/zzzzzzz5oYGZgcnRrXlGgw34bwnhRtI:ZNa/zzzzzzz56XhcJ3jY
Score
7/10
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x0008000000016890-5.dat acprotect -
Deletes itself 1 IoCs
pid Process 2052 cmd.exe -
Loads dropped DLL 1 IoCs
pid Process 2136 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\76B9BA7A.dll 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe -
resource yara_rule behavioral1/memory/2136-0-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral1/files/0x0008000000016890-5.dat upx behavioral1/memory/2136-7-0x0000000010000000-0x0000000010011000-memory.dmp upx behavioral1/memory/2136-9-0x0000000010000000-0x0000000010011000-memory.dmp upx behavioral1/memory/2136-8-0x0000000000400000-0x0000000000409000-memory.dmp upx -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\fOnts\pDuuqr4BgFn65AeW.Ttf 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe -
Modifies registry class 7 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{76B9BA7A-81D0-4979-8598-8471F2AB5186}\InprocServer32 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{76B9BA7A-81D0-4979-8598-8471F2AB5186}\InprocServer32\ = "C:\\Windows\\SysWow64\\76B9BA7A.dll" 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{76B9BA7A-81D0-4979-8598-8471F2AB5186}\InprocServer32\ThreadingModel = "Apartment" 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLsID\{76B9BA7A-81D0-4979-8598-8471F2AB5186}\InprocServer32 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLsID 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{76B9BA7A-81D0-4979-8598-8471F2AB5186} 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2136 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe 2136 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe 2136 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2136 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe Token: SeDebugPrivilege 2136 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe Token: SeDebugPrivilege 2136 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe Token: SeDebugPrivilege 2136 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe Token: SeDebugPrivilege 2136 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe Token: SeDebugPrivilege 2136 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe Token: SeDebugPrivilege 2136 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe Token: SeDebugPrivilege 2136 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe Token: SeDebugPrivilege 2136 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe Token: SeDebugPrivilege 2136 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe Token: SeDebugPrivilege 2136 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe Token: SeDebugPrivilege 2136 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe Token: SeDebugPrivilege 2136 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe Token: SeDebugPrivilege 2136 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe Token: SeDebugPrivilege 2136 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe Token: SeDebugPrivilege 2136 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe Token: SeDebugPrivilege 2136 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe Token: SeDebugPrivilege 2136 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe Token: SeDebugPrivilege 2136 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe Token: SeDebugPrivilege 2136 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe Token: SeDebugPrivilege 2136 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe Token: SeDebugPrivilege 2136 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe Token: SeDebugPrivilege 2136 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe Token: SeDebugPrivilege 2136 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe Token: SeDebugPrivilege 2136 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe Token: SeDebugPrivilege 2136 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe Token: SeDebugPrivilege 2136 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe Token: SeDebugPrivilege 2136 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe Token: SeDebugPrivilege 2136 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe Token: SeDebugPrivilege 2136 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe Token: SeDebugPrivilege 2136 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe Token: SeDebugPrivilege 2136 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe Token: SeDebugPrivilege 2136 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe Token: SeDebugPrivilege 2136 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe Token: SeDebugPrivilege 2136 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe Token: SeDebugPrivilege 2136 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe Token: SeDebugPrivilege 2136 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe Token: SeDebugPrivilege 2136 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe Token: SeDebugPrivilege 2136 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe Token: SeDebugPrivilege 2136 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe Token: SeDebugPrivilege 2136 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe Token: SeDebugPrivilege 2136 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe Token: SeDebugPrivilege 2136 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe Token: SeDebugPrivilege 2136 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe Token: SeDebugPrivilege 2136 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe Token: SeDebugPrivilege 2136 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe Token: SeDebugPrivilege 2136 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe Token: SeDebugPrivilege 2136 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe Token: SeDebugPrivilege 2136 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe Token: SeDebugPrivilege 2136 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe Token: SeDebugPrivilege 2136 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe Token: SeDebugPrivilege 2136 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe Token: SeDebugPrivilege 2136 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe Token: SeDebugPrivilege 2136 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe Token: SeDebugPrivilege 2136 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe Token: SeDebugPrivilege 2136 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe Token: SeDebugPrivilege 2136 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe Token: SeDebugPrivilege 2136 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe Token: SeDebugPrivilege 2136 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe Token: SeDebugPrivilege 2136 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe Token: SeDebugPrivilege 2136 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe Token: SeDebugPrivilege 2136 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe Token: SeDebugPrivilege 2136 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe Token: SeDebugPrivilege 2136 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2136 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2136 wrote to memory of 2052 2136 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe 28 PID 2136 wrote to memory of 2052 2136 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe 28 PID 2136 wrote to memory of 2052 2136 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe 28 PID 2136 wrote to memory of 2052 2136 10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\10d767565d4d02ef2ac8531e941d1a87_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\10D767~1.EXE >> NUL2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2052
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
218KB
MD59d3a2624261f25666f5b4cad91c4540d
SHA183af7a7da29a6c74bff160f06fe7d74cf94d9e7f
SHA256df9d06d097f7f54dedf95a93d0f8fcbb4d1acdcfa23750600d5a14c958e5cb9b
SHA5120fbe9a91b243792e117dafeac748a7a34f6cd6e307a586856976b59eea26ee2dc8d11246e9aa40f71fee2e93ed65c7193d24d4eaa396099fb2dbf26504565877