Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
12/10/2024, 15:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3ab0bd9988295c5486d2b5ce3c2f823f_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
3ab0bd9988295c5486d2b5ce3c2f823f_JaffaCakes118.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
3ab0bd9988295c5486d2b5ce3c2f823f_JaffaCakes118.exe
-
Size
1.5MB
-
MD5
3ab0bd9988295c5486d2b5ce3c2f823f
-
SHA1
c0de6c822926b70acde7e45abdb88f2c01e42f24
-
SHA256
acca3bf979ef6c7831f3a331c14f0d06754fe04b28daca05765d3844541c2872
-
SHA512
ca9f538fe459b7b16853b9198b63c8eaa56c8f8a0f0a18706732d1a608f708bfe8cf75e3e4f082ad29bb1ad6a0aace442b5105ca47e52761f7cd3c61c04cf1cf
-
SSDEEP
24576:ixPiHFcW0Ef2zHpLIofOesgwI7d+qtP2PCKodRrI+4SdrIXxmn3rA4+kaq:+Piw4WHZJHsgH9B2PCLft5dMXxM3rA4h
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2384 ÔÂÉñ.exe -
Loads dropped DLL 9 IoCs
pid Process 2384 ÔÂÉñ.exe 2384 ÔÂÉñ.exe 2384 ÔÂÉñ.exe 2384 ÔÂÉñ.exe 2384 ÔÂÉñ.exe 2384 ÔÂÉñ.exe 2384 ÔÂÉñ.exe 2384 ÔÂÉñ.exe 2384 ÔÂÉñ.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\DNFÊäÈë·¨.ime ÔÂÉñ.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\WINDOWS\ÔÂÉñ.exe 3ab0bd9988295c5486d2b5ce3c2f823f_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ab0bd9988295c5486d2b5ce3c2f823f_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ÔÂÉñ.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main ÔÂÉñ.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2384 ÔÂÉñ.exe 2384 ÔÂÉñ.exe 2384 ÔÂÉñ.exe 2384 ÔÂÉñ.exe 2384 ÔÂÉñ.exe 2384 ÔÂÉñ.exe 2384 ÔÂÉñ.exe 2384 ÔÂÉñ.exe 2384 ÔÂÉñ.exe 2384 ÔÂÉñ.exe 2384 ÔÂÉñ.exe 2384 ÔÂÉñ.exe 2384 ÔÂÉñ.exe 2384 ÔÂÉñ.exe 2384 ÔÂÉñ.exe 2384 ÔÂÉñ.exe 2384 ÔÂÉñ.exe 2384 ÔÂÉñ.exe 2384 ÔÂÉñ.exe 2384 ÔÂÉñ.exe 2384 ÔÂÉñ.exe 2384 ÔÂÉñ.exe 2384 ÔÂÉñ.exe 2384 ÔÂÉñ.exe 2384 ÔÂÉñ.exe 2384 ÔÂÉñ.exe 2384 ÔÂÉñ.exe 2384 ÔÂÉñ.exe 2384 ÔÂÉñ.exe 2384 ÔÂÉñ.exe 2384 ÔÂÉñ.exe 2384 ÔÂÉñ.exe 2384 ÔÂÉñ.exe 2384 ÔÂÉñ.exe 2384 ÔÂÉñ.exe 2384 ÔÂÉñ.exe 2384 ÔÂÉñ.exe 2384 ÔÂÉñ.exe 2384 ÔÂÉñ.exe 2384 ÔÂÉñ.exe 2384 ÔÂÉñ.exe 2384 ÔÂÉñ.exe 2384 ÔÂÉñ.exe 2384 ÔÂÉñ.exe 2384 ÔÂÉñ.exe 2384 ÔÂÉñ.exe 2384 ÔÂÉñ.exe 2384 ÔÂÉñ.exe 2384 ÔÂÉñ.exe 2384 ÔÂÉñ.exe 2384 ÔÂÉñ.exe 2384 ÔÂÉñ.exe 2384 ÔÂÉñ.exe 2384 ÔÂÉñ.exe 2384 ÔÂÉñ.exe 2384 ÔÂÉñ.exe 2384 ÔÂÉñ.exe 2384 ÔÂÉñ.exe 2384 ÔÂÉñ.exe 2384 ÔÂÉñ.exe 2384 ÔÂÉñ.exe 2384 ÔÂÉñ.exe 2384 ÔÂÉñ.exe 2384 ÔÂÉñ.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: 33 2384 ÔÂÉñ.exe Token: SeIncBasePriorityPrivilege 2384 ÔÂÉñ.exe Token: 33 2384 ÔÂÉñ.exe Token: SeIncBasePriorityPrivilege 2384 ÔÂÉñ.exe Token: 33 2384 ÔÂÉñ.exe Token: SeIncBasePriorityPrivilege 2384 ÔÂÉñ.exe Token: 33 2384 ÔÂÉñ.exe Token: SeIncBasePriorityPrivilege 2384 ÔÂÉñ.exe Token: 33 2384 ÔÂÉñ.exe Token: SeIncBasePriorityPrivilege 2384 ÔÂÉñ.exe Token: 33 2384 ÔÂÉñ.exe Token: SeIncBasePriorityPrivilege 2384 ÔÂÉñ.exe Token: 33 2384 ÔÂÉñ.exe Token: SeIncBasePriorityPrivilege 2384 ÔÂÉñ.exe Token: 33 2384 ÔÂÉñ.exe Token: SeIncBasePriorityPrivilege 2384 ÔÂÉñ.exe Token: 33 2384 ÔÂÉñ.exe Token: SeIncBasePriorityPrivilege 2384 ÔÂÉñ.exe Token: 33 2384 ÔÂÉñ.exe Token: SeIncBasePriorityPrivilege 2384 ÔÂÉñ.exe Token: 33 2384 ÔÂÉñ.exe Token: SeIncBasePriorityPrivilege 2384 ÔÂÉñ.exe Token: 33 2384 ÔÂÉñ.exe Token: SeIncBasePriorityPrivilege 2384 ÔÂÉñ.exe Token: 33 2384 ÔÂÉñ.exe Token: SeIncBasePriorityPrivilege 2384 ÔÂÉñ.exe Token: 33 2384 ÔÂÉñ.exe Token: SeIncBasePriorityPrivilege 2384 ÔÂÉñ.exe Token: 33 2384 ÔÂÉñ.exe Token: SeIncBasePriorityPrivilege 2384 ÔÂÉñ.exe Token: 33 2384 ÔÂÉñ.exe Token: SeIncBasePriorityPrivilege 2384 ÔÂÉñ.exe Token: 33 2384 ÔÂÉñ.exe Token: SeIncBasePriorityPrivilege 2384 ÔÂÉñ.exe Token: 33 2384 ÔÂÉñ.exe Token: SeIncBasePriorityPrivilege 2384 ÔÂÉñ.exe Token: 33 2384 ÔÂÉñ.exe Token: SeIncBasePriorityPrivilege 2384 ÔÂÉñ.exe Token: 33 2384 ÔÂÉñ.exe Token: SeIncBasePriorityPrivilege 2384 ÔÂÉñ.exe Token: 33 2384 ÔÂÉñ.exe Token: SeIncBasePriorityPrivilege 2384 ÔÂÉñ.exe Token: 33 2384 ÔÂÉñ.exe Token: SeIncBasePriorityPrivilege 2384 ÔÂÉñ.exe Token: 33 2384 ÔÂÉñ.exe Token: SeIncBasePriorityPrivilege 2384 ÔÂÉñ.exe Token: 33 2384 ÔÂÉñ.exe Token: SeIncBasePriorityPrivilege 2384 ÔÂÉñ.exe Token: 33 2384 ÔÂÉñ.exe Token: SeIncBasePriorityPrivilege 2384 ÔÂÉñ.exe Token: 33 2384 ÔÂÉñ.exe Token: SeIncBasePriorityPrivilege 2384 ÔÂÉñ.exe Token: 33 2384 ÔÂÉñ.exe Token: SeIncBasePriorityPrivilege 2384 ÔÂÉñ.exe Token: 33 2384 ÔÂÉñ.exe Token: SeIncBasePriorityPrivilege 2384 ÔÂÉñ.exe Token: 33 2384 ÔÂÉñ.exe Token: SeIncBasePriorityPrivilege 2384 ÔÂÉñ.exe Token: 33 2384 ÔÂÉñ.exe Token: SeIncBasePriorityPrivilege 2384 ÔÂÉñ.exe Token: 33 2384 ÔÂÉñ.exe Token: SeIncBasePriorityPrivilege 2384 ÔÂÉñ.exe Token: 33 2384 ÔÂÉñ.exe Token: SeIncBasePriorityPrivilege 2384 ÔÂÉñ.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2580 3ab0bd9988295c5486d2b5ce3c2f823f_JaffaCakes118.exe 2580 3ab0bd9988295c5486d2b5ce3c2f823f_JaffaCakes118.exe 2384 ÔÂÉñ.exe 2384 ÔÂÉñ.exe 2384 ÔÂÉñ.exe 2384 ÔÂÉñ.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2580 wrote to memory of 2384 2580 3ab0bd9988295c5486d2b5ce3c2f823f_JaffaCakes118.exe 30 PID 2580 wrote to memory of 2384 2580 3ab0bd9988295c5486d2b5ce3c2f823f_JaffaCakes118.exe 30 PID 2580 wrote to memory of 2384 2580 3ab0bd9988295c5486d2b5ce3c2f823f_JaffaCakes118.exe 30 PID 2580 wrote to memory of 2384 2580 3ab0bd9988295c5486d2b5ce3c2f823f_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ab0bd9988295c5486d2b5ce3c2f823f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3ab0bd9988295c5486d2b5ce3c2f823f_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\WINDOWS\ÔÂÉñ.exeC:\WINDOWS\ÔÂÉñ.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2384
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
960KB
MD5050ad4ad6c724c0198a115416c5b8c08
SHA1ae94bcca1e3342d51ee32133407b9cba79ebb10b
SHA256871be7d4c2760a7bf6ba6e79951b6a24b0e6bef1a942c8ed0c4e81e51d8b72c8
SHA5120a6b3f0e0c872740e60c089c722dd07970a7416337f557838a5cb383336a652407360b95a80c8a64885e12d8e38bd1999103a7fe89e38052087f1bc0fe9f3861
-
Filesize
52KB
MD5b60da4e2e5aceba3ce3d87ee2cd872ee
SHA19bbdbf1f3ce2c000a86e0473da756a4b1031db41
SHA256b581fcc82c0462d60286a80912ab2ce5aca7d7b11c5cff0b5f74716dbb7dc453
SHA512664d6f893484252b339ff8f413a4cf9da9b0ef82ed74b097ba86a5f00b4d9740eef6e8a5b81e8be7e82ae4009928097baf15e65a03f31c4b92e44f593ce39874