Analysis
-
max time kernel
147s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system -
submitted
29-01-2025 12:00
Behavioral task
behavioral1
Sample
JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe
Resource
win7-20241010-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe
Resource
win10v2004-20250129-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe
-
Size
1.2MB
-
MD5
569b8837e675090b6267a8aa90f67363
-
SHA1
fb7f2ab70b691ed5479bbd93476c3f58011aa489
-
SHA256
22eb5b185959f7e0ecab1269748186ba8c4cb291ebc96ae4475a87dcab4f31ae
-
SHA512
e745ca29885918eeb25eeff93b71cc2881d5fab703e1556a488391f0ab2b59b3fab1d35e6f304ada9b09d1249f791c6d4c7098644240b083d3b1d46c181e99e2
-
SSDEEP
24576:TC3bqfFwCGoV9wdGzJUEarzoebZkT+RWj+9iKbzl:23bsF/LKQX4biO6TKbB
Score
10/10
Malware Config
Signatures
-
Modifies firewall policy service 3 TTPs 10 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\july6.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\july6.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 4780 reg.exe 4256 reg.exe 2040 reg.exe 4804 reg.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: 1 1672 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe Token: SeCreateTokenPrivilege 1672 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe Token: SeAssignPrimaryTokenPrivilege 1672 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe Token: SeLockMemoryPrivilege 1672 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe Token: SeIncreaseQuotaPrivilege 1672 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe Token: SeMachineAccountPrivilege 1672 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe Token: SeTcbPrivilege 1672 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe Token: SeSecurityPrivilege 1672 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe Token: SeTakeOwnershipPrivilege 1672 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe Token: SeLoadDriverPrivilege 1672 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe Token: SeSystemProfilePrivilege 1672 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe Token: SeSystemtimePrivilege 1672 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe Token: SeProfSingleProcessPrivilege 1672 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe Token: SeIncBasePriorityPrivilege 1672 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe Token: SeCreatePagefilePrivilege 1672 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe Token: SeCreatePermanentPrivilege 1672 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe Token: SeBackupPrivilege 1672 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe Token: SeRestorePrivilege 1672 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe Token: SeShutdownPrivilege 1672 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe Token: SeDebugPrivilege 1672 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe Token: SeAuditPrivilege 1672 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe Token: SeSystemEnvironmentPrivilege 1672 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe Token: SeChangeNotifyPrivilege 1672 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe Token: SeRemoteShutdownPrivilege 1672 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe Token: SeUndockPrivilege 1672 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe Token: SeSyncAgentPrivilege 1672 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe Token: SeEnableDelegationPrivilege 1672 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe Token: SeManageVolumePrivilege 1672 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe Token: SeImpersonatePrivilege 1672 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe Token: SeCreateGlobalPrivilege 1672 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe Token: 31 1672 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe Token: 32 1672 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe Token: 33 1672 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe Token: 34 1672 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe Token: 35 1672 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1672 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe 1672 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe 1672 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe 1672 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 1672 wrote to memory of 964 1672 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe 85 PID 1672 wrote to memory of 964 1672 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe 85 PID 1672 wrote to memory of 964 1672 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe 85 PID 1672 wrote to memory of 1356 1672 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe 86 PID 1672 wrote to memory of 1356 1672 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe 86 PID 1672 wrote to memory of 1356 1672 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe 86 PID 1672 wrote to memory of 1588 1672 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe 87 PID 1672 wrote to memory of 1588 1672 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe 87 PID 1672 wrote to memory of 1588 1672 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe 87 PID 1672 wrote to memory of 4200 1672 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe 88 PID 1672 wrote to memory of 4200 1672 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe 88 PID 1672 wrote to memory of 4200 1672 JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe 88 PID 1588 wrote to memory of 4780 1588 cmd.exe 93 PID 1588 wrote to memory of 4780 1588 cmd.exe 93 PID 1588 wrote to memory of 4780 1588 cmd.exe 93 PID 964 wrote to memory of 2040 964 cmd.exe 94 PID 964 wrote to memory of 2040 964 cmd.exe 94 PID 964 wrote to memory of 2040 964 cmd.exe 94 PID 4200 wrote to memory of 4256 4200 cmd.exe 95 PID 4200 wrote to memory of 4256 4200 cmd.exe 95 PID 4200 wrote to memory of 4256 4200 cmd.exe 95 PID 1356 wrote to memory of 4804 1356 cmd.exe 96 PID 1356 wrote to memory of 4804 1356 cmd.exe 96 PID 1356 wrote to memory of 4804 1356 cmd.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:964 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2040
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe:*:Enabled:Windows Messanger" /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_569b8837e675090b6267a8aa90f67363.exe:*:Enabled:Windows Messanger" /f3⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:4804
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:4780
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\july6.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\july6.exe:*:Enabled:Windows Messanger" /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\july6.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\july6.exe:*:Enabled:Windows Messanger" /f3⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:4256
-
-