Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
14-12-2024 20:08
Behavioral task
behavioral1
Sample
f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe
-
Size
76KB
-
MD5
f07b561a4d8962e7b146179160b04a6f
-
SHA1
68cc3a847559e3eea90af0ec50dc3283c5ac7493
-
SHA256
eed77293f89f345e046f3ce15a40964608f5034ef8a0ea89555045c873fbc2ac
-
SHA512
ea3bce3d15765b84bd59213cd873f32d5b94691aa86615cd28155eb1c036ae481bc3933d39f48055043fe385995bc96ca9f5c04ae64c67b824e93414566a6f0d
-
SSDEEP
1536:nbfATCplvmEJx4IrCs2C7Oxy5royOlAh9Y:njATCnx4IrccS4oP09Y
Score
6/10
Malware Config
Signatures
-
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\tmipo.bat f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\wpcap.dll f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\‰ –CïQ 5QU Û™U f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe File created C:\Windows\SysWOW64\fat32.sys f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3016 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 3016 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 3016 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 3016 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 3016 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 3016 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 3016 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 3016 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 3016 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 3016 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 3016 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 3016 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 3016 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 3016 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 3016 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 3016 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 3016 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 3016 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 3016 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 3016 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 3016 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 3016 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 3016 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 3016 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 3016 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 3016 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 3016 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 3016 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 3016 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 3016 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 3016 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 3016 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 3016 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 3016 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 3016 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 3016 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 3016 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 3016 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 3016 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 3016 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 3016 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 3016 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 3016 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 3016 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 3016 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 3016 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 3016 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 3016 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 3016 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 3016 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 3016 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 3016 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 3016 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 3016 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 3016 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 3016 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 3016 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 3016 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 3016 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 3016 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 3016 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 3016 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 3016 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 3016 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 472 Process not Found -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeRestorePrivilege 3016 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3016 wrote to memory of 2240 3016 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 30 PID 3016 wrote to memory of 2240 3016 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 30 PID 3016 wrote to memory of 2240 3016 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 30 PID 3016 wrote to memory of 2240 3016 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 30 PID 2240 wrote to memory of 2020 2240 cmd.exe 32 PID 2240 wrote to memory of 2020 2240 cmd.exe 32 PID 2240 wrote to memory of 2020 2240 cmd.exe 32 PID 2240 wrote to memory of 2020 2240 cmd.exe 32 PID 2020 wrote to memory of 1928 2020 net.exe 33 PID 2020 wrote to memory of 1928 2020 net.exe 33 PID 2020 wrote to memory of 1928 2020 net.exe 33 PID 2020 wrote to memory of 1928 2020 net.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\system32\tmipo.bat2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Windows\SysWOW64\net.exenet stop sharedaccess3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess4⤵
- System Location Discovery: System Language Discovery
PID:1928
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
21B
MD57b16cc4ebd5af5d255eeb8a7b487875b
SHA13f679d76efb21f7b2249ddc2a0d8a68d71220d16
SHA2565040cfcc7def4d52830218981dc6cb729abe9eb3b1a38d8df5c56698336098b1
SHA5127f16419eddc8cedb0e133fe482a958cf6997b8b30456a3f3949066e9279fef888e1297065850f77bdae189a5d93e6bc69eb6e33d73ef1e0d64642f2fb2ff61d0