Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04-10-2024 00:26
Static task
static1
Behavioral task
behavioral1
Sample
1113545d1698c9739abfaafeee18e793_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
1113545d1698c9739abfaafeee18e793_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
1113545d1698c9739abfaafeee18e793_JaffaCakes118.exe
-
Size
75KB
-
MD5
1113545d1698c9739abfaafeee18e793
-
SHA1
a1759d9aa0173295179da8c0c3da31759600444f
-
SHA256
ba35311af13c6b3ef2f6c88719c0b749d46d8b67f4816f19b2c408320643702f
-
SHA512
eab1fbb738980991aff3a0451de12882959e5dca637662ae2679ad92836f45fdc3c4cd397df41d9817550aa31df50f6d00ccc23e8a954bc58b34ec1a5900e75d
-
SSDEEP
768:+DovwCsOCNR/ERVoDQGXCTQcrRTeKbRJzN0drsT92Aki51/5ysTfWlA32GWFFAW2:RvwtM3XRd3NErsR2GysT8AIppDVu
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2704 svchost.exe 2584 svchost.exe -
Loads dropped DLL 3 IoCs
pid Process 2656 1113545d1698c9739abfaafeee18e793_JaffaCakes118.exe 2656 1113545d1698c9739abfaafeee18e793_JaffaCakes118.exe 2704 svchost.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\svchost.exe" svchost.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1400 set thread context of 2656 1400 1113545d1698c9739abfaafeee18e793_JaffaCakes118.exe 31 PID 2704 set thread context of 2584 2704 svchost.exe 33 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1113545d1698c9739abfaafeee18e793_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1113545d1698c9739abfaafeee18e793_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 1400 wrote to memory of 2656 1400 1113545d1698c9739abfaafeee18e793_JaffaCakes118.exe 31 PID 1400 wrote to memory of 2656 1400 1113545d1698c9739abfaafeee18e793_JaffaCakes118.exe 31 PID 1400 wrote to memory of 2656 1400 1113545d1698c9739abfaafeee18e793_JaffaCakes118.exe 31 PID 1400 wrote to memory of 2656 1400 1113545d1698c9739abfaafeee18e793_JaffaCakes118.exe 31 PID 1400 wrote to memory of 2656 1400 1113545d1698c9739abfaafeee18e793_JaffaCakes118.exe 31 PID 1400 wrote to memory of 2656 1400 1113545d1698c9739abfaafeee18e793_JaffaCakes118.exe 31 PID 1400 wrote to memory of 2656 1400 1113545d1698c9739abfaafeee18e793_JaffaCakes118.exe 31 PID 1400 wrote to memory of 2656 1400 1113545d1698c9739abfaafeee18e793_JaffaCakes118.exe 31 PID 1400 wrote to memory of 2656 1400 1113545d1698c9739abfaafeee18e793_JaffaCakes118.exe 31 PID 1400 wrote to memory of 2656 1400 1113545d1698c9739abfaafeee18e793_JaffaCakes118.exe 31 PID 1400 wrote to memory of 2656 1400 1113545d1698c9739abfaafeee18e793_JaffaCakes118.exe 31 PID 1400 wrote to memory of 2656 1400 1113545d1698c9739abfaafeee18e793_JaffaCakes118.exe 31 PID 1400 wrote to memory of 2656 1400 1113545d1698c9739abfaafeee18e793_JaffaCakes118.exe 31 PID 1400 wrote to memory of 2656 1400 1113545d1698c9739abfaafeee18e793_JaffaCakes118.exe 31 PID 2656 wrote to memory of 2704 2656 1113545d1698c9739abfaafeee18e793_JaffaCakes118.exe 32 PID 2656 wrote to memory of 2704 2656 1113545d1698c9739abfaafeee18e793_JaffaCakes118.exe 32 PID 2656 wrote to memory of 2704 2656 1113545d1698c9739abfaafeee18e793_JaffaCakes118.exe 32 PID 2656 wrote to memory of 2704 2656 1113545d1698c9739abfaafeee18e793_JaffaCakes118.exe 32 PID 2704 wrote to memory of 2584 2704 svchost.exe 33 PID 2704 wrote to memory of 2584 2704 svchost.exe 33 PID 2704 wrote to memory of 2584 2704 svchost.exe 33 PID 2704 wrote to memory of 2584 2704 svchost.exe 33 PID 2704 wrote to memory of 2584 2704 svchost.exe 33 PID 2704 wrote to memory of 2584 2704 svchost.exe 33 PID 2704 wrote to memory of 2584 2704 svchost.exe 33 PID 2704 wrote to memory of 2584 2704 svchost.exe 33 PID 2704 wrote to memory of 2584 2704 svchost.exe 33 PID 2704 wrote to memory of 2584 2704 svchost.exe 33 PID 2704 wrote to memory of 2584 2704 svchost.exe 33 PID 2704 wrote to memory of 2584 2704 svchost.exe 33 PID 2704 wrote to memory of 2584 2704 svchost.exe 33 PID 2704 wrote to memory of 2584 2704 svchost.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\1113545d1698c9739abfaafeee18e793_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1113545d1698c9739abfaafeee18e793_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\1113545d1698c9739abfaafeee18e793_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1113545d1698c9739abfaafeee18e793_JaffaCakes118.exe2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Microsoft\svchost.exe"C:\Users\Admin\AppData\Local\Microsoft\svchost.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Microsoft\svchost.exeC:\Users\Admin\AppData\Local\Microsoft\svchost.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2584
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
75KB
MD51113545d1698c9739abfaafeee18e793
SHA1a1759d9aa0173295179da8c0c3da31759600444f
SHA256ba35311af13c6b3ef2f6c88719c0b749d46d8b67f4816f19b2c408320643702f
SHA512eab1fbb738980991aff3a0451de12882959e5dca637662ae2679ad92836f45fdc3c4cd397df41d9817550aa31df50f6d00ccc23e8a954bc58b34ec1a5900e75d