Analysis
-
max time kernel
147s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
29/01/2025, 12:00
Behavioral task
behavioral1
Sample
JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe
Resource
win10v2004-20250129-en
General
-
Target
JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe
-
Size
1.2MB
-
MD5
569b8837e675090b6267a8aa90f67363
-
SHA1
fb7f2ab70b691ed5479bbd93476c3f58011aa489
-
SHA256
22eb5b185959f7e0ecab1269748186ba8c4cb291ebc96ae4475a87dcab4f31ae
-
SHA512
e745ca29885918eeb25eeff93b71cc2881d5fab703e1556a488391f0ab2b59b3fab1d35e6f304ada9b09d1249f791c6d4c7098644240b083d3b1d46c181e99e2
-
SSDEEP
24576:TC3bqfFwCGoV9wdGzJUEarzoebZkT+RWj+9iKbzl:23bsF/LKQX4biO6TKbB
Malware Config
Signatures
-
Modifies firewall policy service 3 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\july6.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\july6.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 2692 reg.exe 2888 reg.exe 2904 reg.exe 468 reg.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: 1 2448 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe Token: SeCreateTokenPrivilege 2448 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe Token: SeAssignPrimaryTokenPrivilege 2448 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe Token: SeLockMemoryPrivilege 2448 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe Token: SeIncreaseQuotaPrivilege 2448 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe Token: SeMachineAccountPrivilege 2448 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe Token: SeTcbPrivilege 2448 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe Token: SeSecurityPrivilege 2448 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe Token: SeTakeOwnershipPrivilege 2448 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe Token: SeLoadDriverPrivilege 2448 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe Token: SeSystemProfilePrivilege 2448 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe Token: SeSystemtimePrivilege 2448 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe Token: SeProfSingleProcessPrivilege 2448 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe Token: SeIncBasePriorityPrivilege 2448 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe Token: SeCreatePagefilePrivilege 2448 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe Token: SeCreatePermanentPrivilege 2448 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe Token: SeBackupPrivilege 2448 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe Token: SeRestorePrivilege 2448 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe Token: SeShutdownPrivilege 2448 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe Token: SeDebugPrivilege 2448 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe Token: SeAuditPrivilege 2448 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe Token: SeSystemEnvironmentPrivilege 2448 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe Token: SeChangeNotifyPrivilege 2448 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe Token: SeRemoteShutdownPrivilege 2448 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe Token: SeUndockPrivilege 2448 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe Token: SeSyncAgentPrivilege 2448 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe Token: SeEnableDelegationPrivilege 2448 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe Token: SeManageVolumePrivilege 2448 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe Token: SeImpersonatePrivilege 2448 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe Token: SeCreateGlobalPrivilege 2448 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe Token: 31 2448 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe Token: 32 2448 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe Token: 33 2448 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe Token: 34 2448 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe Token: 35 2448 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2448 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe 2448 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe 2448 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe 2448 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 2448 wrote to memory of 2780 2448 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe 30 PID 2448 wrote to memory of 2780 2448 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe 30 PID 2448 wrote to memory of 2780 2448 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe 30 PID 2448 wrote to memory of 2780 2448 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe 30 PID 2448 wrote to memory of 2796 2448 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe 31 PID 2448 wrote to memory of 2796 2448 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe 31 PID 2448 wrote to memory of 2796 2448 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe 31 PID 2448 wrote to memory of 2796 2448 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe 31 PID 2448 wrote to memory of 2800 2448 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe 32 PID 2448 wrote to memory of 2800 2448 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe 32 PID 2448 wrote to memory of 2800 2448 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe 32 PID 2448 wrote to memory of 2800 2448 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe 32 PID 2448 wrote to memory of 2820 2448 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe 33 PID 2448 wrote to memory of 2820 2448 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe 33 PID 2448 wrote to memory of 2820 2448 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe 33 PID 2448 wrote to memory of 2820 2448 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe 33 PID 2780 wrote to memory of 2888 2780 cmd.exe 40 PID 2780 wrote to memory of 2888 2780 cmd.exe 40 PID 2780 wrote to memory of 2888 2780 cmd.exe 40 PID 2780 wrote to memory of 2888 2780 cmd.exe 40 PID 2800 wrote to memory of 2904 2800 cmd.exe 39 PID 2800 wrote to memory of 2904 2800 cmd.exe 39 PID 2800 wrote to memory of 2904 2800 cmd.exe 39 PID 2800 wrote to memory of 2904 2800 cmd.exe 39 PID 2796 wrote to memory of 2692 2796 cmd.exe 41 PID 2796 wrote to memory of 2692 2796 cmd.exe 41 PID 2796 wrote to memory of 2692 2796 cmd.exe 41 PID 2796 wrote to memory of 2692 2796 cmd.exe 41 PID 2820 wrote to memory of 468 2820 cmd.exe 38 PID 2820 wrote to memory of 468 2820 cmd.exe 38 PID 2820 wrote to memory of 468 2820 cmd.exe 38 PID 2820 wrote to memory of 468 2820 cmd.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2888
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe:*:Enabled:Windows Messanger" /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe:*:Enabled:Windows Messanger" /f3⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2692
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2904
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\july6.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\july6.exe:*:Enabled:Windows Messanger" /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\july6.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\july6.exe:*:Enabled:Windows Messanger" /f3⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:468
-
-