Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
14-12-2024 20:08
Behavioral task
behavioral1
Sample
f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe
-
Size
76KB
-
MD5
f07b561a4d8962e7b146179160b04a6f
-
SHA1
68cc3a847559e3eea90af0ec50dc3283c5ac7493
-
SHA256
eed77293f89f345e046f3ce15a40964608f5034ef8a0ea89555045c873fbc2ac
-
SHA512
ea3bce3d15765b84bd59213cd873f32d5b94691aa86615cd28155eb1c036ae481bc3933d39f48055043fe385995bc96ca9f5c04ae64c67b824e93414566a6f0d
-
SSDEEP
1536:nbfATCplvmEJx4IrCs2C7Oxy5royOlAh9Y:njATCnx4IrccS4oP09Y
Score
6/10
Malware Config
Signatures
-
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\tmipo.bat f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\wpcap.dll f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\tutility.txt f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe File created C:\Windows\SysWOW64\fat32.sys f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1612 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 1612 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 1612 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 1612 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 1612 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 1612 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 1612 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 1612 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 1612 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 1612 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 1612 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 1612 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 1612 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 1612 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 1612 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 1612 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 1612 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 1612 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 1612 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 1612 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 1612 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 1612 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 1612 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 1612 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 1612 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 1612 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 1612 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 1612 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 1612 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 1612 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 1612 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 1612 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 1612 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 1612 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 1612 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 1612 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 1612 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 1612 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 1612 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 1612 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 1612 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 1612 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 1612 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 1612 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 1612 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 1612 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 1612 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 1612 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 1612 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 1612 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 1612 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 1612 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 1612 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 1612 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 1612 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 1612 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 1612 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 1612 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 1612 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 1612 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 1612 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 1612 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 1612 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 1612 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 660 Process not Found -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeRestorePrivilege 1612 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1612 wrote to memory of 1896 1612 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 83 PID 1612 wrote to memory of 1896 1612 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 83 PID 1612 wrote to memory of 1896 1612 f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe 83 PID 1896 wrote to memory of 720 1896 cmd.exe 85 PID 1896 wrote to memory of 720 1896 cmd.exe 85 PID 1896 wrote to memory of 720 1896 cmd.exe 85 PID 720 wrote to memory of 3148 720 net.exe 86 PID 720 wrote to memory of 3148 720 net.exe 86 PID 720 wrote to memory of 3148 720 net.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f07b561a4d8962e7b146179160b04a6f_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\system32\tmipo.bat2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Windows\SysWOW64\net.exenet stop sharedaccess3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:720 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess4⤵
- System Location Discovery: System Language Discovery
PID:3148
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
21B
MD57b16cc4ebd5af5d255eeb8a7b487875b
SHA13f679d76efb21f7b2249ddc2a0d8a68d71220d16
SHA2565040cfcc7def4d52830218981dc6cb729abe9eb3b1a38d8df5c56698336098b1
SHA5127f16419eddc8cedb0e133fe482a958cf6997b8b30456a3f3949066e9279fef888e1297065850f77bdae189a5d93e6bc69eb6e33d73ef1e0d64642f2fb2ff61d0