9b09322db14e46f87c9ca53b1ea291576d6b25be37582fab8d05664037bbc824

Analysis

max time kernel
147s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20250129-en
resource tags

arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
submitted
31-01-2025 14:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_6ade719c71467e9f8565e9a72c1b29c1.exe
Size

448KB
MD5

6ade719c71467e9f8565e9a72c1b29c1
SHA1

3cbcbd872bdc68d913a7d4e1e3cc9eed7c2dcb1a
SHA256

9b09322db14e46f87c9ca53b1ea291576d6b25be37582fab8d05664037bbc824
SHA512

5fffcde66c27dc58e5e6d7e2199788e9c6e1a26c91f9904afbaef8fb820bf191ff870e80a9d1306b2b0fcc57a4f857b2245c3e1042019a569d823c9aa72b9eb3
SSDEEP

6144:jh5IjKmFs4Hb4I2HIEi+nPHawdn0/JRSerTWIdeFjkZM6jI7F1eZ9A3d:d5IjKCsC4IsKRFqIQFjkZM6jI7TeZe

Score

10^/10

defense_evasion discovery

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 10 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\installShield8\javaw.exe = "C:\\Users\\Admin\\AppData\\Roaming\\installShield8\\javaw.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6ade719c71467e9f8565e9a72c1b29c1.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\JaffaCakes118_6ade719c71467e9f8565e9a72c1b29c1.exe:*:Enabled:Windows Messanger"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_6ade719c71467e9f8565e9a72c1b29c1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
3756	reg.exe
2416	reg.exe
4784	reg.exe
4468	reg.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: 1	4444	JaffaCakes118_6ade719c71467e9f8565e9a72c1b29c1.exe
Token: SeCreateTokenPrivilege	4444	JaffaCakes118_6ade719c71467e9f8565e9a72c1b29c1.exe
Token: SeAssignPrimaryTokenPrivilege	4444	JaffaCakes118_6ade719c71467e9f8565e9a72c1b29c1.exe
Token: SeLockMemoryPrivilege	4444	JaffaCakes118_6ade719c71467e9f8565e9a72c1b29c1.exe
Token: SeIncreaseQuotaPrivilege	4444	JaffaCakes118_6ade719c71467e9f8565e9a72c1b29c1.exe
Token: SeMachineAccountPrivilege	4444	JaffaCakes118_6ade719c71467e9f8565e9a72c1b29c1.exe
Token: SeTcbPrivilege	4444	JaffaCakes118_6ade719c71467e9f8565e9a72c1b29c1.exe
Token: SeSecurityPrivilege	4444	JaffaCakes118_6ade719c71467e9f8565e9a72c1b29c1.exe
Token: SeTakeOwnershipPrivilege	4444	JaffaCakes118_6ade719c71467e9f8565e9a72c1b29c1.exe
Token: SeLoadDriverPrivilege	4444	JaffaCakes118_6ade719c71467e9f8565e9a72c1b29c1.exe
Token: SeSystemProfilePrivilege	4444	JaffaCakes118_6ade719c71467e9f8565e9a72c1b29c1.exe
Token: SeSystemtimePrivilege	4444	JaffaCakes118_6ade719c71467e9f8565e9a72c1b29c1.exe
Token: SeProfSingleProcessPrivilege	4444	JaffaCakes118_6ade719c71467e9f8565e9a72c1b29c1.exe
Token: SeIncBasePriorityPrivilege	4444	JaffaCakes118_6ade719c71467e9f8565e9a72c1b29c1.exe
Token: SeCreatePagefilePrivilege	4444	JaffaCakes118_6ade719c71467e9f8565e9a72c1b29c1.exe
Token: SeCreatePermanentPrivilege	4444	JaffaCakes118_6ade719c71467e9f8565e9a72c1b29c1.exe
Token: SeBackupPrivilege	4444	JaffaCakes118_6ade719c71467e9f8565e9a72c1b29c1.exe
Token: SeRestorePrivilege	4444	JaffaCakes118_6ade719c71467e9f8565e9a72c1b29c1.exe
Token: SeShutdownPrivilege	4444	JaffaCakes118_6ade719c71467e9f8565e9a72c1b29c1.exe
Token: SeDebugPrivilege	4444	JaffaCakes118_6ade719c71467e9f8565e9a72c1b29c1.exe
Token: SeAuditPrivilege	4444	JaffaCakes118_6ade719c71467e9f8565e9a72c1b29c1.exe
Token: SeSystemEnvironmentPrivilege	4444	JaffaCakes118_6ade719c71467e9f8565e9a72c1b29c1.exe
Token: SeChangeNotifyPrivilege	4444	JaffaCakes118_6ade719c71467e9f8565e9a72c1b29c1.exe
Token: SeRemoteShutdownPrivilege	4444	JaffaCakes118_6ade719c71467e9f8565e9a72c1b29c1.exe
Token: SeUndockPrivilege	4444	JaffaCakes118_6ade719c71467e9f8565e9a72c1b29c1.exe
Token: SeSyncAgentPrivilege	4444	JaffaCakes118_6ade719c71467e9f8565e9a72c1b29c1.exe
Token: SeEnableDelegationPrivilege	4444	JaffaCakes118_6ade719c71467e9f8565e9a72c1b29c1.exe
Token: SeManageVolumePrivilege	4444	JaffaCakes118_6ade719c71467e9f8565e9a72c1b29c1.exe
Token: SeImpersonatePrivilege	4444	JaffaCakes118_6ade719c71467e9f8565e9a72c1b29c1.exe
Token: SeCreateGlobalPrivilege	4444	JaffaCakes118_6ade719c71467e9f8565e9a72c1b29c1.exe
Token: 31	4444	JaffaCakes118_6ade719c71467e9f8565e9a72c1b29c1.exe
Token: 32	4444	JaffaCakes118_6ade719c71467e9f8565e9a72c1b29c1.exe
Token: 33	4444	JaffaCakes118_6ade719c71467e9f8565e9a72c1b29c1.exe
Token: 34	4444	JaffaCakes118_6ade719c71467e9f8565e9a72c1b29c1.exe
Token: 35	4444	JaffaCakes118_6ade719c71467e9f8565e9a72c1b29c1.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4444	JaffaCakes118_6ade719c71467e9f8565e9a72c1b29c1.exe
4444	JaffaCakes118_6ade719c71467e9f8565e9a72c1b29c1.exe
4444	JaffaCakes118_6ade719c71467e9f8565e9a72c1b29c1.exe
4444	JaffaCakes118_6ade719c71467e9f8565e9a72c1b29c1.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4444 wrote to memory of 1192	4444	JaffaCakes118_6ade719c71467e9f8565e9a72c1b29c1.exe	85
PID 4444 wrote to memory of 1192	4444	JaffaCakes118_6ade719c71467e9f8565e9a72c1b29c1.exe	85
PID 4444 wrote to memory of 1192	4444	JaffaCakes118_6ade719c71467e9f8565e9a72c1b29c1.exe	85
PID 4444 wrote to memory of 1072	4444	JaffaCakes118_6ade719c71467e9f8565e9a72c1b29c1.exe	86
PID 4444 wrote to memory of 1072	4444	JaffaCakes118_6ade719c71467e9f8565e9a72c1b29c1.exe	86
PID 4444 wrote to memory of 1072	4444	JaffaCakes118_6ade719c71467e9f8565e9a72c1b29c1.exe	86
PID 4444 wrote to memory of 3464	4444	JaffaCakes118_6ade719c71467e9f8565e9a72c1b29c1.exe	87
PID 4444 wrote to memory of 3464	4444	JaffaCakes118_6ade719c71467e9f8565e9a72c1b29c1.exe	87
PID 4444 wrote to memory of 3464	4444	JaffaCakes118_6ade719c71467e9f8565e9a72c1b29c1.exe	87
PID 4444 wrote to memory of 3176	4444	JaffaCakes118_6ade719c71467e9f8565e9a72c1b29c1.exe	88
PID 4444 wrote to memory of 3176	4444	JaffaCakes118_6ade719c71467e9f8565e9a72c1b29c1.exe	88
PID 4444 wrote to memory of 3176	4444	JaffaCakes118_6ade719c71467e9f8565e9a72c1b29c1.exe	88
PID 1192 wrote to memory of 3756	1192	cmd.exe	93
PID 1192 wrote to memory of 3756	1192	cmd.exe	93
PID 1192 wrote to memory of 3756	1192	cmd.exe	93
PID 3176 wrote to memory of 2416	3176	cmd.exe	94
PID 3176 wrote to memory of 2416	3176	cmd.exe	94
PID 3176 wrote to memory of 2416	3176	cmd.exe	94
PID 3464 wrote to memory of 4784	3464	cmd.exe	95
PID 3464 wrote to memory of 4784	3464	cmd.exe	95
PID 3464 wrote to memory of 4784	3464	cmd.exe	95
PID 1072 wrote to memory of 4468	1072	cmd.exe	96
PID 1072 wrote to memory of 4468	1072	cmd.exe	96
PID 1072 wrote to memory of 4468	1072	cmd.exe	96

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6ade719c71467e9f8565e9a72c1b29c1.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6ade719c71467e9f8565e9a72c1b29c1.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4444
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1192
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - Modifies firewall policy service
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:3756
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6ade719c71467e9f8565e9a72c1b29c1.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6ade719c71467e9f8565e9a72c1b29c1.exe:*:Enabled:Windows Messanger" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1072
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6ade719c71467e9f8565e9a72c1b29c1.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6ade719c71467e9f8565e9a72c1b29c1.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - Modifies firewall policy service
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4468
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3464
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - Modifies firewall policy service
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4784
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\installShield8\javaw.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\installShield8\javaw.exe:*:Enabled:Windows Messanger" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3176
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\installShield8\javaw.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\installShield8\javaw.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - Modifies firewall policy service
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2416