Analysis
-
max time kernel
149s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
27/01/2025, 20:51
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_439286137108822ef85b7c6e6a48507d.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_439286137108822ef85b7c6e6a48507d.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_439286137108822ef85b7c6e6a48507d.exe
-
Size
405KB
-
MD5
439286137108822ef85b7c6e6a48507d
-
SHA1
d83ad3e686031cf8eae13aa6aa4900e0570ae35c
-
SHA256
c613719eb016e14e37d9848b5b49c5406ce492ec09cc7b751bcd393a822d5027
-
SHA512
993cd318bc62fb9073c7d9ada8c87b43d821678caae31fb80915da473dab00ab17bd9cf7ff145cd50008fc619e16b6a2a0bce3e78710851c267ae8abdde38b35
-
SSDEEP
12288:IBzja/4ajw9b1k1EzbLaGjiJvZ/p4/q9n3QNF:o0zqbYEfLzqv4S9n3Qb
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4372 SVCHOSI.EXE -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\Deleteme.bat JaffaCakes118_439286137108822ef85b7c6e6a48507d.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File created C:\Program Files\Internet Explorer\SVCHOSI.EXE JaffaCakes118_439286137108822ef85b7c6e6a48507d.exe File opened for modification C:\Program Files\Internet Explorer\SVCHOSI.EXE JaffaCakes118_439286137108822ef85b7c6e6a48507d.exe File created C:\Program Files\Internet Explorer\servise.exe JaffaCakes118_439286137108822ef85b7c6e6a48507d.exe File opened for modification C:\Program Files\Internet Explorer\servise.exe JaffaCakes118_439286137108822ef85b7c6e6a48507d.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_439286137108822ef85b7c6e6a48507d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOSI.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4372 SVCHOSI.EXE 4372 SVCHOSI.EXE 4372 SVCHOSI.EXE 4372 SVCHOSI.EXE 4372 SVCHOSI.EXE 4372 SVCHOSI.EXE 4372 SVCHOSI.EXE 4372 SVCHOSI.EXE 4372 SVCHOSI.EXE 4372 SVCHOSI.EXE 4372 SVCHOSI.EXE 4372 SVCHOSI.EXE 4372 SVCHOSI.EXE 4372 SVCHOSI.EXE 4372 SVCHOSI.EXE 4372 SVCHOSI.EXE 4372 SVCHOSI.EXE 4372 SVCHOSI.EXE 4372 SVCHOSI.EXE 4372 SVCHOSI.EXE 4372 SVCHOSI.EXE 4372 SVCHOSI.EXE 4372 SVCHOSI.EXE 4372 SVCHOSI.EXE 4372 SVCHOSI.EXE 4372 SVCHOSI.EXE 4372 SVCHOSI.EXE 4372 SVCHOSI.EXE 4372 SVCHOSI.EXE 4372 SVCHOSI.EXE 4372 SVCHOSI.EXE 4372 SVCHOSI.EXE 4372 SVCHOSI.EXE 4372 SVCHOSI.EXE 4372 SVCHOSI.EXE 4372 SVCHOSI.EXE 4372 SVCHOSI.EXE 4372 SVCHOSI.EXE 4372 SVCHOSI.EXE 4372 SVCHOSI.EXE 4372 SVCHOSI.EXE 4372 SVCHOSI.EXE 4372 SVCHOSI.EXE 4372 SVCHOSI.EXE 4372 SVCHOSI.EXE 4372 SVCHOSI.EXE 4372 SVCHOSI.EXE 4372 SVCHOSI.EXE 4372 SVCHOSI.EXE 4372 SVCHOSI.EXE 4372 SVCHOSI.EXE 4372 SVCHOSI.EXE 4372 SVCHOSI.EXE 4372 SVCHOSI.EXE 4372 SVCHOSI.EXE 4372 SVCHOSI.EXE 4372 SVCHOSI.EXE 4372 SVCHOSI.EXE 4372 SVCHOSI.EXE 4372 SVCHOSI.EXE 4372 SVCHOSI.EXE 4372 SVCHOSI.EXE 4372 SVCHOSI.EXE 4372 SVCHOSI.EXE -
Suspicious use of AdjustPrivilegeToken 14 IoCs
description pid Process Token: 33 4372 SVCHOSI.EXE Token: SeIncBasePriorityPrivilege 4372 SVCHOSI.EXE Token: 33 4372 SVCHOSI.EXE Token: SeIncBasePriorityPrivilege 4372 SVCHOSI.EXE Token: 33 4372 SVCHOSI.EXE Token: SeIncBasePriorityPrivilege 4372 SVCHOSI.EXE Token: 33 4372 SVCHOSI.EXE Token: SeIncBasePriorityPrivilege 4372 SVCHOSI.EXE Token: 33 4372 SVCHOSI.EXE Token: SeIncBasePriorityPrivilege 4372 SVCHOSI.EXE Token: 33 4372 SVCHOSI.EXE Token: SeIncBasePriorityPrivilege 4372 SVCHOSI.EXE Token: 33 4372 SVCHOSI.EXE Token: SeIncBasePriorityPrivilege 4372 SVCHOSI.EXE -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1208 wrote to memory of 4372 1208 JaffaCakes118_439286137108822ef85b7c6e6a48507d.exe 83 PID 1208 wrote to memory of 4372 1208 JaffaCakes118_439286137108822ef85b7c6e6a48507d.exe 83 PID 1208 wrote to memory of 4372 1208 JaffaCakes118_439286137108822ef85b7c6e6a48507d.exe 83 PID 1208 wrote to memory of 3552 1208 JaffaCakes118_439286137108822ef85b7c6e6a48507d.exe 84 PID 1208 wrote to memory of 3552 1208 JaffaCakes118_439286137108822ef85b7c6e6a48507d.exe 84 PID 1208 wrote to memory of 3552 1208 JaffaCakes118_439286137108822ef85b7c6e6a48507d.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_439286137108822ef85b7c6e6a48507d.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_439286137108822ef85b7c6e6a48507d.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Program Files\Internet Explorer\SVCHOSI.EXE"C:\Program Files\Internet Explorer\SVCHOSI.EXE" -NETBC2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4372
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat2⤵
- System Location Discovery: System Language Discovery
PID:3552
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
405KB
MD5439286137108822ef85b7c6e6a48507d
SHA1d83ad3e686031cf8eae13aa6aa4900e0570ae35c
SHA256c613719eb016e14e37d9848b5b49c5406ce492ec09cc7b751bcd393a822d5027
SHA512993cd318bc62fb9073c7d9ada8c87b43d821678caae31fb80915da473dab00ab17bd9cf7ff145cd50008fc619e16b6a2a0bce3e78710851c267ae8abdde38b35
-
Filesize
212B
MD577af4eb3445c82345aab63161a71c90d
SHA1b5062500839862f796676fa761d288b7de090b99
SHA25644cdada70fade48284d04f958cb08ad7f3907e90b050478d19a8920355355d30
SHA512ddb11264b37b8a6a0dd3402a55ccb9e4502e12fbbbd8bfde6bb62141cb3400fce3234e1cb33e57f7d15dece82b10ccdf6c1ca2fe00f4805ec5fb5325907daa75