Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08-10-2024 22:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
261e865a0baacb81fb2f85522d18ba92_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
261e865a0baacb81fb2f85522d18ba92_JaffaCakes118.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
261e865a0baacb81fb2f85522d18ba92_JaffaCakes118.exe
-
Size
24KB
-
MD5
261e865a0baacb81fb2f85522d18ba92
-
SHA1
57fc51fd46b2eb7fb6eede85aa98aa89e56d661f
-
SHA256
909bc47fc75fbeaa574625e57ed07f7a2a099f7e16f458b7e6de170d2095f892
-
SHA512
10997b65930d249ae70ff5de6eebdb314e9c08528db324ef6924be1f2f1bc54e8cd0b9e4e25b7441456b487bd7965cdc35fc87e922ad4c75c00903e1b6a7f0c2
-
SSDEEP
384:KjtgNppp8gf6HJZx6dhsYteY0XcLBxwpODcvh:K4DUgswbdqVZ
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\ProgramData\\22CC6C32.exe" 261e865a0baacb81fb2f85522d18ba92_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\ProgramData\\22CC6C32.exe" 261e865a0baacb81fb2f85522d18ba92_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 261e865a0baacb81fb2f85522d18ba92_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2076 261e865a0baacb81fb2f85522d18ba92_JaffaCakes118.exe 2076 261e865a0baacb81fb2f85522d18ba92_JaffaCakes118.exe 2076 261e865a0baacb81fb2f85522d18ba92_JaffaCakes118.exe 2076 261e865a0baacb81fb2f85522d18ba92_JaffaCakes118.exe 2076 261e865a0baacb81fb2f85522d18ba92_JaffaCakes118.exe 2076 261e865a0baacb81fb2f85522d18ba92_JaffaCakes118.exe 2076 261e865a0baacb81fb2f85522d18ba92_JaffaCakes118.exe 2076 261e865a0baacb81fb2f85522d18ba92_JaffaCakes118.exe 2076 261e865a0baacb81fb2f85522d18ba92_JaffaCakes118.exe 2076 261e865a0baacb81fb2f85522d18ba92_JaffaCakes118.exe 2076 261e865a0baacb81fb2f85522d18ba92_JaffaCakes118.exe 2076 261e865a0baacb81fb2f85522d18ba92_JaffaCakes118.exe 2076 261e865a0baacb81fb2f85522d18ba92_JaffaCakes118.exe 2076 261e865a0baacb81fb2f85522d18ba92_JaffaCakes118.exe 2076 261e865a0baacb81fb2f85522d18ba92_JaffaCakes118.exe 2076 261e865a0baacb81fb2f85522d18ba92_JaffaCakes118.exe 2076 261e865a0baacb81fb2f85522d18ba92_JaffaCakes118.exe 2076 261e865a0baacb81fb2f85522d18ba92_JaffaCakes118.exe 2076 261e865a0baacb81fb2f85522d18ba92_JaffaCakes118.exe 2076 261e865a0baacb81fb2f85522d18ba92_JaffaCakes118.exe 2076 261e865a0baacb81fb2f85522d18ba92_JaffaCakes118.exe 2076 261e865a0baacb81fb2f85522d18ba92_JaffaCakes118.exe 2076 261e865a0baacb81fb2f85522d18ba92_JaffaCakes118.exe 2076 261e865a0baacb81fb2f85522d18ba92_JaffaCakes118.exe 2076 261e865a0baacb81fb2f85522d18ba92_JaffaCakes118.exe 2076 261e865a0baacb81fb2f85522d18ba92_JaffaCakes118.exe 2076 261e865a0baacb81fb2f85522d18ba92_JaffaCakes118.exe 2076 261e865a0baacb81fb2f85522d18ba92_JaffaCakes118.exe 2076 261e865a0baacb81fb2f85522d18ba92_JaffaCakes118.exe 2076 261e865a0baacb81fb2f85522d18ba92_JaffaCakes118.exe 2076 261e865a0baacb81fb2f85522d18ba92_JaffaCakes118.exe 2076 261e865a0baacb81fb2f85522d18ba92_JaffaCakes118.exe 2076 261e865a0baacb81fb2f85522d18ba92_JaffaCakes118.exe 2076 261e865a0baacb81fb2f85522d18ba92_JaffaCakes118.exe 2076 261e865a0baacb81fb2f85522d18ba92_JaffaCakes118.exe 2076 261e865a0baacb81fb2f85522d18ba92_JaffaCakes118.exe 2076 261e865a0baacb81fb2f85522d18ba92_JaffaCakes118.exe 2076 261e865a0baacb81fb2f85522d18ba92_JaffaCakes118.exe 2076 261e865a0baacb81fb2f85522d18ba92_JaffaCakes118.exe 2076 261e865a0baacb81fb2f85522d18ba92_JaffaCakes118.exe 2076 261e865a0baacb81fb2f85522d18ba92_JaffaCakes118.exe 2076 261e865a0baacb81fb2f85522d18ba92_JaffaCakes118.exe 2076 261e865a0baacb81fb2f85522d18ba92_JaffaCakes118.exe 2076 261e865a0baacb81fb2f85522d18ba92_JaffaCakes118.exe 2076 261e865a0baacb81fb2f85522d18ba92_JaffaCakes118.exe 2076 261e865a0baacb81fb2f85522d18ba92_JaffaCakes118.exe 2076 261e865a0baacb81fb2f85522d18ba92_JaffaCakes118.exe 2076 261e865a0baacb81fb2f85522d18ba92_JaffaCakes118.exe 2076 261e865a0baacb81fb2f85522d18ba92_JaffaCakes118.exe 2076 261e865a0baacb81fb2f85522d18ba92_JaffaCakes118.exe 2076 261e865a0baacb81fb2f85522d18ba92_JaffaCakes118.exe 2076 261e865a0baacb81fb2f85522d18ba92_JaffaCakes118.exe 2076 261e865a0baacb81fb2f85522d18ba92_JaffaCakes118.exe 2076 261e865a0baacb81fb2f85522d18ba92_JaffaCakes118.exe 2076 261e865a0baacb81fb2f85522d18ba92_JaffaCakes118.exe 2076 261e865a0baacb81fb2f85522d18ba92_JaffaCakes118.exe 2076 261e865a0baacb81fb2f85522d18ba92_JaffaCakes118.exe 2076 261e865a0baacb81fb2f85522d18ba92_JaffaCakes118.exe 2076 261e865a0baacb81fb2f85522d18ba92_JaffaCakes118.exe 2076 261e865a0baacb81fb2f85522d18ba92_JaffaCakes118.exe 2076 261e865a0baacb81fb2f85522d18ba92_JaffaCakes118.exe 2076 261e865a0baacb81fb2f85522d18ba92_JaffaCakes118.exe 2076 261e865a0baacb81fb2f85522d18ba92_JaffaCakes118.exe 2076 261e865a0baacb81fb2f85522d18ba92_JaffaCakes118.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2076 261e865a0baacb81fb2f85522d18ba92_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\261e865a0baacb81fb2f85522d18ba92_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\261e865a0baacb81fb2f85522d18ba92_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
PID:2076