Analysis
-
max time kernel
139s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
17/10/2024, 23:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5431bff5401e3e24b0f513f8769b3db2_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
5431bff5401e3e24b0f513f8769b3db2_JaffaCakes118.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
5431bff5401e3e24b0f513f8769b3db2_JaffaCakes118.exe
-
Size
268KB
-
MD5
5431bff5401e3e24b0f513f8769b3db2
-
SHA1
3621ae5b0b24d091cceb4d1812ef8f3c3109d84e
-
SHA256
81fd2c2ecf527f180445cd700a54444274b552ea2dd492faafdd34a2bfc332ce
-
SHA512
54154077f6d2403bb292bd5c8f16cce52d2cf03505819a80525d298c136309a0c044609a5fdf1e740bb0a8c963b72779ee671523bfb47bcbb80e26ef07b79788
-
SSDEEP
3072:+9J0oZp4YybvNwyXJ4fSgePSeTqPBwOB+9RuKwun9494SD60aySh5fGWtrSPIJmT:EJ0S4YybvyyX0S+PTBkdwu+LuBBLtuD
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\WINDOWS\SysWOW64\Helicon\server1.iNi.iNi 5431bff5401e3e24b0f513f8769b3db2_JaffaCakes118.exe File opened for modification C:\WINDOWS\SysWOW64\Helicon\server3.iNi 5431bff5401e3e24b0f513f8769b3db2_JaffaCakes118.exe File opened for modification C:\WINDOWS\SysWOW64\Helicon\server4.iNi 5431bff5401e3e24b0f513f8769b3db2_JaffaCakes118.exe File opened for modification C:\WINDOWS\SysWOW64\Helicon\server6.iNi 5431bff5401e3e24b0f513f8769b3db2_JaffaCakes118.exe File opened for modification C:\WINDOWS\SysWOW64\Helicon\server7.iNi 5431bff5401e3e24b0f513f8769b3db2_JaffaCakes118.exe File opened for modification C:\WINDOWS\SysWOW64\Helicon\server10.iNi 5431bff5401e3e24b0f513f8769b3db2_JaffaCakes118.exe File opened for modification C:\WINDOWS\SysWOW64\Helicon\ser999ver9.iNi 5431bff5401e3e24b0f513f8769b3db2_JaffaCakes118.exe File opened for modification C:\WINDOWS\SysWOW64\Helicon\server2.iNi 5431bff5401e3e24b0f513f8769b3db2_JaffaCakes118.exe File opened for modification C:\WINDOWS\SysWOW64\Helicon\server5.iNi 5431bff5401e3e24b0f513f8769b3db2_JaffaCakes118.exe File opened for modification C:\WINDOWS\SysWOW64\Helicon\server8.iNi 5431bff5401e3e24b0f513f8769b3db2_JaffaCakes118.exe File opened for modification C:\WINDOWS\SysWOW64\Helicon\server9.iNi 5431bff5401e3e24b0f513f8769b3db2_JaffaCakes118.exe File opened for modification C:\WINDOWS\SysWOW64\Helicon\ser888ver10.iNi 5431bff5401e3e24b0f513f8769b3db2_JaffaCakes118.exe -
Drops file in Program Files directory 25 IoCs
description ioc Process File opened for modification C:\Program Files\Helicon\SeaPort5.iNi 5431bff5401e3e24b0f513f8769b3db2_JaffaCakes118.exe File opened for modification C:\Program Files\Helicon\SeaPort6.iNi 5431bff5401e3e24b0f513f8769b3db2_JaffaCakes118.exe File opened for modification C:\Program Files\CybeRLink\CybeRLink1.iNi 5431bff5401e3e24b0f513f8769b3db2_JaffaCakes118.exe File opened for modification C:\Program Files\CybeRLink\CybeRLink2.iNi 5431bff5401e3e24b0f513f8769b3db2_JaffaCakes118.exe File opened for modification C:\Program Files\CybeRLink\CybeRLink4.iNi 5431bff5401e3e24b0f513f8769b3db2_JaffaCakes118.exe File opened for modification C:\Program Files\Helicon\SeaPort2.iNi 5431bff5401e3e24b0f513f8769b3db2_JaffaCakes118.exe File opened for modification C:\Program Files\Helicon\SeaPort8.iNi 5431bff5401e3e24b0f513f8769b3db2_JaffaCakes118.exe File opened for modification C:\Program Files\CybeRLink\CybeRLink10.iNi 5431bff5401e3e24b0f513f8769b3db2_JaffaCakes118.exe File opened for modification C:\Program Files\CybeRLink\Cybe888RLink8.iNi 5431bff5401e3e24b0f513f8769b3db2_JaffaCakes118.exe File opened for modification C:\Program Files\NetMeeting\test.log 5431bff5401e3e24b0f513f8769b3db2_JaffaCakes118.exe File opened for modification C:\Program Files\Helicon\SeaPort4.iNi 5431bff5401e3e24b0f513f8769b3db2_JaffaCakes118.exe File opened for modification C:\Program Files\Helicon\SeaPort7.iNi 5431bff5401e3e24b0f513f8769b3db2_JaffaCakes118.exe File opened for modification C:\Program Files\Helicon\SeaPort9.iNi 5431bff5401e3e24b0f513f8769b3db2_JaffaCakes118.exe File opened for modification C:\Program Files\Helicon\Sea888Port8.iNi 5431bff5401e3e24b0f513f8769b3db2_JaffaCakes118.exe File opened for modification C:\Program Files\Helicon\Sea999Port9.iNi 5431bff5401e3e24b0f513f8769b3db2_JaffaCakes118.exe File opened for modification C:\Program Files\CybeRLink\CybeRLink3.iNi 5431bff5401e3e24b0f513f8769b3db2_JaffaCakes118.exe File opened for modification C:\Program Files\CybeRLink\CybeRLink5.iNi 5431bff5401e3e24b0f513f8769b3db2_JaffaCakes118.exe File opened for modification C:\Program Files\CybeRLink\CybeRLink8.iNi 5431bff5401e3e24b0f513f8769b3db2_JaffaCakes118.exe File opened for modification C:\Program Files\CybeRLink\CybeRLink9.iNi 5431bff5401e3e24b0f513f8769b3db2_JaffaCakes118.exe File opened for modification C:\Program Files\CybeRLink\Cybe999RLink9.iNi 5431bff5401e3e24b0f513f8769b3db2_JaffaCakes118.exe File opened for modification C:\Program Files\Helicon\SeaPort1.iNi 5431bff5401e3e24b0f513f8769b3db2_JaffaCakes118.exe File opened for modification C:\Program Files\Helicon\SeaPort3.iNi 5431bff5401e3e24b0f513f8769b3db2_JaffaCakes118.exe File opened for modification C:\Program Files\Helicon\SeaPort10.iNi 5431bff5401e3e24b0f513f8769b3db2_JaffaCakes118.exe File opened for modification C:\Program Files\CybeRLink\CybeRLink6.iNi 5431bff5401e3e24b0f513f8769b3db2_JaffaCakes118.exe File opened for modification C:\Program Files\CybeRLink\CybeRLink7.iNi 5431bff5401e3e24b0f513f8769b3db2_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5431bff5401e3e24b0f513f8769b3db2_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3596 5431bff5401e3e24b0f513f8769b3db2_JaffaCakes118.exe 3596 5431bff5401e3e24b0f513f8769b3db2_JaffaCakes118.exe 3596 5431bff5401e3e24b0f513f8769b3db2_JaffaCakes118.exe 3596 5431bff5401e3e24b0f513f8769b3db2_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5431bff5401e3e24b0f513f8769b3db2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5431bff5401e3e24b0f513f8769b3db2_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3596