Analysis
-
max time kernel
139s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
15/10/2024, 18:48
Static task
static1
Behavioral task
behavioral1
Sample
496f1defa92daf684818e5d161c71e8b_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
496f1defa92daf684818e5d161c71e8b_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
496f1defa92daf684818e5d161c71e8b_JaffaCakes118.exe
-
Size
658KB
-
MD5
496f1defa92daf684818e5d161c71e8b
-
SHA1
de21e1d8c5645f4550f09d11295b81293164a0f1
-
SHA256
745115e5515092ad108ad14211fc1f03e0dd4730bfeb79b5fadd753a4ba14f36
-
SHA512
805a88a93ddd3b4dc9bafaebf91723a7db70302007b8603a33c6cdea4f769ca15f62c84a689fef131be73fe15984491bc434e6a8a1d51839a441bf9a933a50fc
-
SSDEEP
12288:qa11Gr3+pfNixGTdIkIxJIEo3gMH70mVogKp4tQ3BfS6oN+qESVBx7neivjX/I:qWixGpuIEow7WG4tQxa6ojxvnei7
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2564 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2452 usеrinit.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4472 set thread context of 2564 4472 496f1defa92daf684818e5d161c71e8b_JaffaCakes118.exe 87 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 496f1defa92daf684818e5d161c71e8b_JaffaCakes118.exe -
Modifies registry class 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{f456cbc2-bfc5-6f65-aca0-986e7eba0308}\u = "131087" 496f1defa92daf684818e5d161c71e8b_JaffaCakes118.exe Key created \registry\machine\Software\Classes\WOW6432Node\Interface\{f456cbc2-bfc5-6f65-aca0-986e7eba0308} 496f1defa92daf684818e5d161c71e8b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{f456cbc2-bfc5-6f65-aca0-986e7eba0308}\u = "131087" 496f1defa92daf684818e5d161c71e8b_JaffaCakes118.exe Key created \registry\machine\Software\Classes\Interface\{f456cbc2-bfc5-6f65-aca0-986e7eba0308} 496f1defa92daf684818e5d161c71e8b_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2452 usеrinit.exe 2452 usеrinit.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4472 496f1defa92daf684818e5d161c71e8b_JaffaCakes118.exe Token: SeSecurityPrivilege 4472 496f1defa92daf684818e5d161c71e8b_JaffaCakes118.exe Token: SeDebugPrivilege 2452 usеrinit.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4472 wrote to memory of 2564 4472 496f1defa92daf684818e5d161c71e8b_JaffaCakes118.exe 87 PID 4472 wrote to memory of 2564 4472 496f1defa92daf684818e5d161c71e8b_JaffaCakes118.exe 87 PID 4472 wrote to memory of 2564 4472 496f1defa92daf684818e5d161c71e8b_JaffaCakes118.exe 87 PID 4472 wrote to memory of 2564 4472 496f1defa92daf684818e5d161c71e8b_JaffaCakes118.exe 87 PID 4472 wrote to memory of 2452 4472 496f1defa92daf684818e5d161c71e8b_JaffaCakes118.exe 89 PID 4472 wrote to memory of 2452 4472 496f1defa92daf684818e5d161c71e8b_JaffaCakes118.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\496f1defa92daf684818e5d161c71e8b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\496f1defa92daf684818e5d161c71e8b_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Deletes itself
PID:2564
-
-
\??\globalroot\systemroot\system32\usеrinit.exe/install2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2452
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
139KB
MD54acd14244d2cd76d06939163127cfb10
SHA175f3e3c764f7d20c9950f5410f753f3210bcc2e7
SHA25629b5b65a1cdf119ac7c6c9df76c6843b25a81bd00aa5a5e995ec675e34bf1acb
SHA512001504da15c1825102479ba379b0be7ec15e779626d450d9d763552d7e1ac71f5bb86110f9361363bd401aabc53cdfd2d554480aec8bef85ed8c7b03cebf4031
-
Filesize
718KB
MD500b7dcb1c108c6bf90e7e39967c1aefb
SHA14becd3315f45fd51d0cbfccbca5adcf67ca4981f
SHA256bf2d44267ee00434ed7d6129f00e6c9544f3890e3a17f7b82522f3008cce703d
SHA5124debf89c69f5e864e0195efda35968f2b5f95051f7ae9638484e000210ddb9f6dfc12cdfae08b0c20e12838e20a3cd26032e090ca4c6aeaa921982a204cc3cfb