Analysis
-
max time kernel
148s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
27/01/2025, 15:10
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_40da04fcf5c478f81c2ad99e0078b643.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_40da04fcf5c478f81c2ad99e0078b643.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_40da04fcf5c478f81c2ad99e0078b643.exe
-
Size
106KB
-
MD5
40da04fcf5c478f81c2ad99e0078b643
-
SHA1
bdb3e0336ce7040841b095b8b12c6b8630406a7a
-
SHA256
d0009e117bc2212da7d1c94b5fb90793f8d7fe2ed462e24c87dafd8bb8c93e99
-
SHA512
a730a97e7ee8b9f5416abc3d3c64ed231c2b1d6abcf941aba6d8e5300ac518c0a7e2a3c493cc4a19abad5ed8d6e0bc8a63d121f28a08725ab2e9ea45a4a0d64d
-
SSDEEP
3072:Qkjte7YxTW8OmbhUMyPagMVVVVVVVVVVVVx:hI7WgMVVVVVVVVVVVVx
Malware Config
Signatures
-
Executes dropped EXE 10 IoCs
pid Process 2344 wins.exe 2768 wins.exe 2864 wins.exe 1932 wins.exe 920 wins.exe 2800 wins.exe 1908 wins.exe 2088 wins.exe 588 wins.exe 1532 wins.exe -
Loads dropped DLL 20 IoCs
pid Process 764 JaffaCakes118_40da04fcf5c478f81c2ad99e0078b643.exe 764 JaffaCakes118_40da04fcf5c478f81c2ad99e0078b643.exe 2344 wins.exe 2344 wins.exe 2768 wins.exe 2768 wins.exe 2864 wins.exe 2864 wins.exe 1932 wins.exe 1932 wins.exe 920 wins.exe 920 wins.exe 2800 wins.exe 2800 wins.exe 1908 wins.exe 1908 wins.exe 2088 wins.exe 2088 wins.exe 588 wins.exe 588 wins.exe -
Drops file in System32 directory 22 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\wins.exe wins.exe File opened for modification C:\Windows\SysWOW64\wins.exe wins.exe File created C:\Windows\SysWOW64\wins.exe wins.exe File opened for modification C:\Windows\SysWOW64\wins.exe wins.exe File opened for modification C:\Windows\SysWOW64\wins.exe wins.exe File created C:\Windows\SysWOW64\wins.exe wins.exe File created C:\Windows\SysWOW64\wins.exe JaffaCakes118_40da04fcf5c478f81c2ad99e0078b643.exe File created C:\Windows\SysWOW64\wins.exe wins.exe File opened for modification C:\Windows\SysWOW64\wins.exe wins.exe File created C:\Windows\SysWOW64\wins.exe wins.exe File opened for modification C:\Windows\SysWOW64\wins.exe wins.exe File opened for modification C:\Windows\SysWOW64\wins.exe wins.exe File opened for modification C:\Windows\SysWOW64\wins.exe wins.exe File opened for modification C:\Windows\SysWOW64\wins.exe wins.exe File created C:\Windows\SysWOW64\wins.exe wins.exe File created C:\Windows\SysWOW64\wins.exe wins.exe File opened for modification C:\Windows\SysWOW64\wins.exe JaffaCakes118_40da04fcf5c478f81c2ad99e0078b643.exe File created C:\Windows\SysWOW64\wins.exe wins.exe File created C:\Windows\SysWOW64\wins.exe wins.exe File created C:\Windows\SysWOW64\wins.exe wins.exe File opened for modification C:\Windows\SysWOW64\wins.exe wins.exe File created C:\Windows\SysWOW64\wins.exe wins.exe -
System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wins.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wins.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wins.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wins.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wins.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wins.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wins.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wins.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wins.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wins.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_40da04fcf5c478f81c2ad99e0078b643.exe -
Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 764 wrote to memory of 2344 764 JaffaCakes118_40da04fcf5c478f81c2ad99e0078b643.exe 31 PID 764 wrote to memory of 2344 764 JaffaCakes118_40da04fcf5c478f81c2ad99e0078b643.exe 31 PID 764 wrote to memory of 2344 764 JaffaCakes118_40da04fcf5c478f81c2ad99e0078b643.exe 31 PID 764 wrote to memory of 2344 764 JaffaCakes118_40da04fcf5c478f81c2ad99e0078b643.exe 31 PID 2344 wrote to memory of 2768 2344 wins.exe 32 PID 2344 wrote to memory of 2768 2344 wins.exe 32 PID 2344 wrote to memory of 2768 2344 wins.exe 32 PID 2344 wrote to memory of 2768 2344 wins.exe 32 PID 2768 wrote to memory of 2864 2768 wins.exe 33 PID 2768 wrote to memory of 2864 2768 wins.exe 33 PID 2768 wrote to memory of 2864 2768 wins.exe 33 PID 2768 wrote to memory of 2864 2768 wins.exe 33 PID 2864 wrote to memory of 1932 2864 wins.exe 34 PID 2864 wrote to memory of 1932 2864 wins.exe 34 PID 2864 wrote to memory of 1932 2864 wins.exe 34 PID 2864 wrote to memory of 1932 2864 wins.exe 34 PID 1932 wrote to memory of 920 1932 wins.exe 35 PID 1932 wrote to memory of 920 1932 wins.exe 35 PID 1932 wrote to memory of 920 1932 wins.exe 35 PID 1932 wrote to memory of 920 1932 wins.exe 35 PID 920 wrote to memory of 2800 920 wins.exe 36 PID 920 wrote to memory of 2800 920 wins.exe 36 PID 920 wrote to memory of 2800 920 wins.exe 36 PID 920 wrote to memory of 2800 920 wins.exe 36 PID 2800 wrote to memory of 1908 2800 wins.exe 38 PID 2800 wrote to memory of 1908 2800 wins.exe 38 PID 2800 wrote to memory of 1908 2800 wins.exe 38 PID 2800 wrote to memory of 1908 2800 wins.exe 38 PID 1908 wrote to memory of 2088 1908 wins.exe 39 PID 1908 wrote to memory of 2088 1908 wins.exe 39 PID 1908 wrote to memory of 2088 1908 wins.exe 39 PID 1908 wrote to memory of 2088 1908 wins.exe 39 PID 2088 wrote to memory of 588 2088 wins.exe 40 PID 2088 wrote to memory of 588 2088 wins.exe 40 PID 2088 wrote to memory of 588 2088 wins.exe 40 PID 2088 wrote to memory of 588 2088 wins.exe 40 PID 588 wrote to memory of 1532 588 wins.exe 41 PID 588 wrote to memory of 1532 588 wins.exe 41 PID 588 wrote to memory of 1532 588 wins.exe 41 PID 588 wrote to memory of 1532 588 wins.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_40da04fcf5c478f81c2ad99e0078b643.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_40da04fcf5c478f81c2ad99e0078b643.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Windows\SysWOW64\wins.exeC:\Windows\system32\wins.exe 472 "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_40da04fcf5c478f81c2ad99e0078b643.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Windows\SysWOW64\wins.exeC:\Windows\system32\wins.exe 536 "C:\Windows\SysWOW64\wins.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Windows\SysWOW64\wins.exeC:\Windows\system32\wins.exe 540 "C:\Windows\SysWOW64\wins.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Windows\SysWOW64\wins.exeC:\Windows\system32\wins.exe 532 "C:\Windows\SysWOW64\wins.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Windows\SysWOW64\wins.exeC:\Windows\system32\wins.exe 528 "C:\Windows\SysWOW64\wins.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Windows\SysWOW64\wins.exeC:\Windows\system32\wins.exe 548 "C:\Windows\SysWOW64\wins.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Windows\SysWOW64\wins.exeC:\Windows\system32\wins.exe 564 "C:\Windows\SysWOW64\wins.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Windows\SysWOW64\wins.exeC:\Windows\system32\wins.exe 544 "C:\Windows\SysWOW64\wins.exe"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Windows\SysWOW64\wins.exeC:\Windows\system32\wins.exe 552 "C:\Windows\SysWOW64\wins.exe"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:588 -
C:\Windows\SysWOW64\wins.exeC:\Windows\system32\wins.exe 568 "C:\Windows\SysWOW64\wins.exe"11⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1532
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
106KB
MD540da04fcf5c478f81c2ad99e0078b643
SHA1bdb3e0336ce7040841b095b8b12c6b8630406a7a
SHA256d0009e117bc2212da7d1c94b5fb90793f8d7fe2ed462e24c87dafd8bb8c93e99
SHA512a730a97e7ee8b9f5416abc3d3c64ed231c2b1d6abcf941aba6d8e5300ac518c0a7e2a3c493cc4a19abad5ed8d6e0bc8a63d121f28a08725ab2e9ea45a4a0d64d