Analysis
-
max time kernel
15s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09-10-2024 04:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2b2b8610e47066b972b87ceea61e2556_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2b2b8610e47066b972b87ceea61e2556_JaffaCakes118.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2b2b8610e47066b972b87ceea61e2556_JaffaCakes118.exe
-
Size
60KB
-
MD5
2b2b8610e47066b972b87ceea61e2556
-
SHA1
8c133f972946d0438056140c567366f5bc848b51
-
SHA256
c012055f97b35840b74aa0f2bb164cb971e1b696a52b3cb53d82aa12142d0b21
-
SHA512
d3da031a8c6fa197a35c28422534972c66061ebc1f1c02ca06f9bfa45eec2fa83483c6a69189304e55be298a3dfca8413c6f35e1d8a2b75bd834cb5d14ffa425
-
SSDEEP
768:DrqPi5bLAeLMLEovY/M5GQBJFV+PZ45/M5GQBJ0:SPkbLSEoQUgi3Vem5Ugia
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 51 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\dxdiag.exe 2b2b8610e47066b972b87ceea61e2556_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\esentutl.exe 2b2b8610e47066b972b87ceea61e2556_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\eventcreate.exe 2b2b8610e47066b972b87ceea61e2556_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\net1.exe 2b2b8610e47066b972b87ceea61e2556_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ntoskrnl.exe 2b2b8610e47066b972b87ceea61e2556_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\proquota.exe 2b2b8610e47066b972b87ceea61e2556_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\dcomcnfg.exe 2b2b8610e47066b972b87ceea61e2556_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\cttune.exe 2b2b8610e47066b972b87ceea61e2556_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\cttunesvr.exe 2b2b8610e47066b972b87ceea61e2556_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\isoburn.exe 2b2b8610e47066b972b87ceea61e2556_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\msfeedssync.exe 2b2b8610e47066b972b87ceea61e2556_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\osk.exe 2b2b8610e47066b972b87ceea61e2556_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\RegisterIEPKEYs.exe 2b2b8610e47066b972b87ceea61e2556_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesProtection.exe 2b2b8610e47066b972b87ceea61e2556_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\cmstp.exe 2b2b8610e47066b972b87ceea61e2556_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\taskeng.exe 2b2b8610e47066b972b87ceea61e2556_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\diskraid.exe 2b2b8610e47066b972b87ceea61e2556_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\PresentationHost.exe 2b2b8610e47066b972b87ceea61e2556_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ReAgentc.exe 2b2b8610e47066b972b87ceea61e2556_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\cmdl32.exe 2b2b8610e47066b972b87ceea61e2556_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\dvdplay.exe 2b2b8610e47066b972b87ceea61e2556_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ftp.exe 2b2b8610e47066b972b87ceea61e2556_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\LocationNotifications.exe 2b2b8610e47066b972b87ceea61e2556_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\schtasks.exe 2b2b8610e47066b972b87ceea61e2556_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ComputerDefaults.exe 2b2b8610e47066b972b87ceea61e2556_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\dllhost.exe 2b2b8610e47066b972b87ceea61e2556_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ktmutil.exe 2b2b8610e47066b972b87ceea61e2556_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\runas.exe 2b2b8610e47066b972b87ceea61e2556_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\bthudtask.exe 2b2b8610e47066b972b87ceea61e2556_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\help.exe 2b2b8610e47066b972b87ceea61e2556_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\iscsicpl.exe 2b2b8610e47066b972b87ceea61e2556_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\mfpmp.exe 2b2b8610e47066b972b87ceea61e2556_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\mspaint.exe 2b2b8610e47066b972b87ceea61e2556_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\perfhost.exe 2b2b8610e47066b972b87ceea61e2556_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\RMActivate_ssp.exe 2b2b8610e47066b972b87ceea61e2556_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\subst.exe 2b2b8610e47066b972b87ceea61e2556_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\forfiles.exe 2b2b8610e47066b972b87ceea61e2556_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\wusa.exe 2b2b8610e47066b972b87ceea61e2556_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\TsWpfWrp.exe 2b2b8610e47066b972b87ceea61e2556_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\dialer.exe 2b2b8610e47066b972b87ceea61e2556_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\rasautou.exe 2b2b8610e47066b972b87ceea61e2556_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\recover.exe 2b2b8610e47066b972b87ceea61e2556_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\vssadmin.exe 2b2b8610e47066b972b87ceea61e2556_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\chkdsk.exe 2b2b8610e47066b972b87ceea61e2556_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\auditpol.exe 2b2b8610e47066b972b87ceea61e2556_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\cscript.exe 2b2b8610e47066b972b87ceea61e2556_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\doskey.exe 2b2b8610e47066b972b87ceea61e2556_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\MuiUnattend.exe 2b2b8610e47066b972b87ceea61e2556_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\net.exe 2b2b8610e47066b972b87ceea61e2556_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\winrs.exe 2b2b8610e47066b972b87ceea61e2556_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\attrib.exe 2b2b8610e47066b972b87ceea61e2556_JaffaCakes118.exe -
Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification C:\Windows\bfsvc.exe 2b2b8610e47066b972b87ceea61e2556_JaffaCakes118.exe File opened for modification C:\Windows\ehome\ehvid.exe 2b2b8610e47066b972b87ceea61e2556_JaffaCakes118.exe File opened for modification C:\Windows\hh.exe 2b2b8610e47066b972b87ceea61e2556_JaffaCakes118.exe File opened for modification C:\Windows\notepad.exe 2b2b8610e47066b972b87ceea61e2556_JaffaCakes118.exe File opened for modification C:\Windows\winhlp32.exe 2b2b8610e47066b972b87ceea61e2556_JaffaCakes118.exe File opened for modification C:\Windows\write.exe 2b2b8610e47066b972b87ceea61e2556_JaffaCakes118.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2780 880 WerFault.exe 29 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2b2b8610e47066b972b87ceea61e2556_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 880 wrote to memory of 2780 880 2b2b8610e47066b972b87ceea61e2556_JaffaCakes118.exe 30 PID 880 wrote to memory of 2780 880 2b2b8610e47066b972b87ceea61e2556_JaffaCakes118.exe 30 PID 880 wrote to memory of 2780 880 2b2b8610e47066b972b87ceea61e2556_JaffaCakes118.exe 30 PID 880 wrote to memory of 2780 880 2b2b8610e47066b972b87ceea61e2556_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b2b8610e47066b972b87ceea61e2556_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2b2b8610e47066b972b87ceea61e2556_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 880 -s 362⤵
- Program crash
PID:2780
-