Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
29-11-2024 07:41
Behavioral task
behavioral1
Sample
afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe
-
Size
76KB
-
MD5
afcfdba2912e471d45cc95278ac64b90
-
SHA1
adfc9e7a6a73c078fd30576a26010a8f291c082d
-
SHA256
cdb90f310916756a4eddf9e509f00f60faadee8134ea925e3fe4c94d0c05066a
-
SHA512
4d8362edf8bc4f4083eaa62dded3f75dfb56d4cd21fb2142c3b41f55290f05e90b08b28560d20b5d4ebdefd68fc036b29e55d5d02b3984d7a4c1169c869eb0c5
-
SSDEEP
768:CUBMqCMcwdmgZH3lpUer9DtTuSChpnc0pK5IrhFohs2C7OoMy5fhho+/Ocl2KHAz:CUBaqlGkTq4IrCs2C7Oxy5rosOlAh9Y
Score
6/10
Malware Config
Signatures
-
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\tmipo.bat afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\wpcap.dll afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\tutilitïqý‚= afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe File created C:\Windows\SysWOW64\fat32.sys afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1400 afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe 1400 afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe 1400 afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe 1400 afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe 1400 afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe 1400 afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe 1400 afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe 1400 afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe 1400 afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe 1400 afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe 1400 afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe 1400 afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe 1400 afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe 1400 afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe 1400 afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe 1400 afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe 1400 afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe 1400 afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe 1400 afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe 1400 afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe 1400 afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe 1400 afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe 1400 afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe 1400 afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe 1400 afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe 1400 afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe 1400 afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe 1400 afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe 1400 afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe 1400 afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe 1400 afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe 1400 afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe 1400 afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe 1400 afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe 1400 afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe 1400 afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe 1400 afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe 1400 afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe 1400 afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe 1400 afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe 1400 afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe 1400 afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe 1400 afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe 1400 afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe 1400 afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe 1400 afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe 1400 afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe 1400 afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe 1400 afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe 1400 afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe 1400 afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe 1400 afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe 1400 afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe 1400 afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe 1400 afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe 1400 afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe 1400 afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe 1400 afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe 1400 afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe 1400 afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe 1400 afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe 1400 afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe 1400 afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe 1400 afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 476 Process not Found -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeRestorePrivilege 1400 afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1400 wrote to memory of 2812 1400 afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe 31 PID 1400 wrote to memory of 2812 1400 afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe 31 PID 1400 wrote to memory of 2812 1400 afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe 31 PID 1400 wrote to memory of 2812 1400 afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe 31 PID 2812 wrote to memory of 2900 2812 cmd.exe 33 PID 2812 wrote to memory of 2900 2812 cmd.exe 33 PID 2812 wrote to memory of 2900 2812 cmd.exe 33 PID 2812 wrote to memory of 2900 2812 cmd.exe 33 PID 2900 wrote to memory of 2688 2900 net.exe 34 PID 2900 wrote to memory of 2688 2900 net.exe 34 PID 2900 wrote to memory of 2688 2900 net.exe 34 PID 2900 wrote to memory of 2688 2900 net.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\system32\tmipo.bat2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\SysWOW64\net.exenet stop sharedaccess3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess4⤵
- System Location Discovery: System Language Discovery
PID:2688
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
21B
MD57b16cc4ebd5af5d255eeb8a7b487875b
SHA13f679d76efb21f7b2249ddc2a0d8a68d71220d16
SHA2565040cfcc7def4d52830218981dc6cb729abe9eb3b1a38d8df5c56698336098b1
SHA5127f16419eddc8cedb0e133fe482a958cf6997b8b30456a3f3949066e9279fef888e1297065850f77bdae189a5d93e6bc69eb6e33d73ef1e0d64642f2fb2ff61d0