Analysis
- max time kernel
147s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20250129-en - resource tags
arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system - submitted
04/02/2025, 02:05
Behavioral task
behavioral1
Sample
JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe
Resource
win7-20241010-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe
Resource
win10v2004-20250129-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe
- Size 336KB
- Sample250204-chwvcssrfl
- SHA256 ac7aeeb43f9acd3e9213192a67fbb7457b85515963383888d85c5cd220739354
- MD5 8ece90742c8755a207b7795e2426f25d
- SHA1 9eaed4fdb188ad35b81c76bea27689012d77575b
- SHA512 79a59e6eabd0923da3bfd9dc468ec3ca2ff826a88869d00a885f4dbd50a7afbdfe23acbabde9d06ba06eac32bdcccee1c15eb6675ba113e66f40401717fcd0af
- SSDEEP 6144:hG78LjzOANvSAsQLqF9pXMiY3sGB6UduRfLtcc:o7kmAN6omFMb3sGB6UduRfLac
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies firewall policy service 3 TTPs 10 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\taskmgr.exe = "C:\\Users\\Admin\\AppData\\Roaming\\taskmgr.exe:*:Enabled:Windows Messanger" reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe - System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe - Modifies registry key 1 TTPs 4 IoCs
pid Process 984 reg.exe 4472 reg.exe 3936 reg.exe 4700 reg.exe - Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: 1 1852 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe Token: SeCreateTokenPrivilege 1852 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe Token: SeAssignPrimaryTokenPrivilege 1852 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe Token: SeLockMemoryPrivilege 1852 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe Token: SeIncreaseQuotaPrivilege 1852 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe Token: SeMachineAccountPrivilege 1852 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe Token: SeTcbPrivilege 1852 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe Token: SeSecurityPrivilege 1852 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe Token: SeTakeOwnershipPrivilege 1852 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe Token: SeLoadDriverPrivilege 1852 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe Token: SeSystemProfilePrivilege 1852 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe Token: SeSystemtimePrivilege 1852 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe Token: SeProfSingleProcessPrivilege 1852 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe Token: SeIncBasePriorityPrivilege 1852 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe Token: SeCreatePagefilePrivilege 1852 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe Token: SeCreatePermanentPrivilege 1852 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe Token: SeBackupPrivilege 1852 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe Token: SeRestorePrivilege 1852 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe Token: SeShutdownPrivilege 1852 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe Token: SeDebugPrivilege 1852 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe Token: SeAuditPrivilege 1852 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe Token: SeSystemEnvironmentPrivilege 1852 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe Token: SeChangeNotifyPrivilege 1852 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe Token: SeRemoteShutdownPrivilege 1852 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe Token: SeUndockPrivilege 1852 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe Token: SeSyncAgentPrivilege 1852 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe Token: SeEnableDelegationPrivilege 1852 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe Token: SeManageVolumePrivilege 1852 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe Token: SeImpersonatePrivilege 1852 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe Token: SeCreateGlobalPrivilege 1852 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe Token: 31 1852 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe Token: 32 1852 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe Token: 33 1852 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe Token: 34 1852 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe Token: 35 1852 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1852 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe 1852 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe 1852 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe - Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 1852 wrote to memory of 4360 1852 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe 84 PID 1852 wrote to memory of 4360 1852 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe 84 PID 1852 wrote to memory of 4360 1852 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe 84 PID 1852 wrote to memory of 3940 1852 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe 85 PID 1852 wrote to memory of 3940 1852 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe 85 PID 1852 wrote to memory of 3940 1852 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe 85 PID 1852 wrote to memory of 880 1852 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe 86 PID 1852 wrote to memory of 880 1852 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe 86 PID 1852 wrote to memory of 880 1852 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe 86 PID 1852 wrote to memory of 3556 1852 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe 87 PID 1852 wrote to memory of 3556 1852 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe 87 PID 1852 wrote to memory of 3556 1852 JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe 87 PID 4360 wrote to memory of 984 4360 cmd.exe 92 PID 4360 wrote to memory of 984 4360 cmd.exe 92 PID 4360 wrote to memory of 984 4360 cmd.exe 92 PID 3940 wrote to memory of 3936 3940 cmd.exe 93 PID 3940 wrote to memory of 3936 3940 cmd.exe 93 PID 3940 wrote to memory of 3936 3940 cmd.exe 93 PID 3556 wrote to memory of 4472 3556 cmd.exe 94 PID 3556 wrote to memory of 4472 3556 cmd.exe 94 PID 3556 wrote to memory of 4472 3556 cmd.exe 94 PID 880 wrote to memory of 4700 880 cmd.exe 95 PID 880 wrote to memory of 4700 880 cmd.exe 95 PID 880 wrote to memory of 4700 880 cmd.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:984
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe:*:Enabled:Windows Messanger" /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8ece90742c8755a207b7795e2426f25d.exe:*:Enabled:Windows Messanger" /f3⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:3936
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:4700
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\taskmgr.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\taskmgr.exe:*:Enabled:Windows Messanger" /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\taskmgr.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\taskmgr.exe:*:Enabled:Windows Messanger" /f3⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:4472
-
-