Analysis
-
max time kernel
147s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
04-02-2025 02:05
Behavioral task
behavioral1
Sample
JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe
Resource
win7-20241010-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe
Resource
win10v2004-20250129-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe
-
Size
336KB
-
MD5
8ece90742c8755a207b7795e2426f25d
-
SHA1
9eaed4fdb188ad35b81c76bea27689012d77575b
-
SHA256
ac7aeeb43f9acd3e9213192a67fbb7457b85515963383888d85c5cd220739354
-
SHA512
79a59e6eabd0923da3bfd9dc468ec3ca2ff826a88869d00a885f4dbd50a7afbdfe23acbabde9d06ba06eac32bdcccee1c15eb6675ba113e66f40401717fcd0af
-
SSDEEP
6144:hG78LjzOANvSAsQLqF9pXMiY3sGB6UduRfLtcc:o7kmAN6omFMb3sGB6UduRfLac
Score
10/10
Malware Config
Signatures
-
Modifies firewall policy service 3 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\taskmgr.exe = "C:\\Users\\Admin\\AppData\\Roaming\\taskmgr.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 2464 reg.exe 3020 reg.exe 332 reg.exe 2508 reg.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: 1 2636 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe Token: SeCreateTokenPrivilege 2636 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe Token: SeAssignPrimaryTokenPrivilege 2636 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe Token: SeLockMemoryPrivilege 2636 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe Token: SeIncreaseQuotaPrivilege 2636 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe Token: SeMachineAccountPrivilege 2636 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe Token: SeTcbPrivilege 2636 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe Token: SeSecurityPrivilege 2636 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe Token: SeTakeOwnershipPrivilege 2636 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe Token: SeLoadDriverPrivilege 2636 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe Token: SeSystemProfilePrivilege 2636 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe Token: SeSystemtimePrivilege 2636 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe Token: SeProfSingleProcessPrivilege 2636 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe Token: SeIncBasePriorityPrivilege 2636 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe Token: SeCreatePagefilePrivilege 2636 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe Token: SeCreatePermanentPrivilege 2636 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe Token: SeBackupPrivilege 2636 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe Token: SeRestorePrivilege 2636 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe Token: SeShutdownPrivilege 2636 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe Token: SeDebugPrivilege 2636 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe Token: SeAuditPrivilege 2636 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe Token: SeSystemEnvironmentPrivilege 2636 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe Token: SeChangeNotifyPrivilege 2636 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe Token: SeRemoteShutdownPrivilege 2636 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe Token: SeUndockPrivilege 2636 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe Token: SeSyncAgentPrivilege 2636 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe Token: SeEnableDelegationPrivilege 2636 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe Token: SeManageVolumePrivilege 2636 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe Token: SeImpersonatePrivilege 2636 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe Token: SeCreateGlobalPrivilege 2636 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe Token: 31 2636 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe Token: 32 2636 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe Token: 33 2636 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe Token: 34 2636 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe Token: 35 2636 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2636 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe 2636 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe 2636 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 2636 wrote to memory of 2140 2636 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe 30 PID 2636 wrote to memory of 2140 2636 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe 30 PID 2636 wrote to memory of 2140 2636 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe 30 PID 2636 wrote to memory of 2140 2636 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe 30 PID 2636 wrote to memory of 2056 2636 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe 31 PID 2636 wrote to memory of 2056 2636 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe 31 PID 2636 wrote to memory of 2056 2636 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe 31 PID 2636 wrote to memory of 2056 2636 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe 31 PID 2636 wrote to memory of 2616 2636 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe 32 PID 2636 wrote to memory of 2616 2636 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe 32 PID 2636 wrote to memory of 2616 2636 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe 32 PID 2636 wrote to memory of 2616 2636 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe 32 PID 2636 wrote to memory of 2604 2636 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe 33 PID 2636 wrote to memory of 2604 2636 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe 33 PID 2636 wrote to memory of 2604 2636 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe 33 PID 2636 wrote to memory of 2604 2636 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe 33 PID 2056 wrote to memory of 2508 2056 cmd.exe 38 PID 2056 wrote to memory of 2508 2056 cmd.exe 38 PID 2056 wrote to memory of 2508 2056 cmd.exe 38 PID 2056 wrote to memory of 2508 2056 cmd.exe 38 PID 2140 wrote to memory of 2464 2140 cmd.exe 41 PID 2140 wrote to memory of 2464 2140 cmd.exe 41 PID 2140 wrote to memory of 2464 2140 cmd.exe 41 PID 2140 wrote to memory of 2464 2140 cmd.exe 41 PID 2604 wrote to memory of 3020 2604 cmd.exe 40 PID 2604 wrote to memory of 3020 2604 cmd.exe 40 PID 2604 wrote to memory of 3020 2604 cmd.exe 40 PID 2604 wrote to memory of 3020 2604 cmd.exe 40 PID 2616 wrote to memory of 332 2616 cmd.exe 39 PID 2616 wrote to memory of 332 2616 cmd.exe 39 PID 2616 wrote to memory of 332 2616 cmd.exe 39 PID 2616 wrote to memory of 332 2616 cmd.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2464
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe:*:Enabled:Windows Messanger" /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe:*:Enabled:Windows Messanger" /f3⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2508
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:332
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\taskmgr.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\taskmgr.exe:*:Enabled:Windows Messanger" /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\taskmgr.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\taskmgr.exe:*:Enabled:Windows Messanger" /f3⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:3020
-
-