2308aa65f6312fa81e82bc345c1e219517b5596a8b0470f51de9a6a57f7ad16a

Analysis

max time kernel
147s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2025, 08:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe
Size

420KB
MD5

6fbc6ed2d1570ec735bb8a5b6cd124e9
SHA1

f0c9f75b01e5676d7e4983ace6a43b230b98682d
SHA256

2308aa65f6312fa81e82bc345c1e219517b5596a8b0470f51de9a6a57f7ad16a
SHA512

300ea880f4bf247d0d7a6ec4aa6ad3f6847b794bf94c01640fea6d3fff6bd06919d608f10c11de3e45c8d7bd7851dde1e5c20d23c9468238b3bda50dbc5c4035
SSDEEP

6144:KfZivnaPAQ6BHng5HaqGg779vT/pQNCbw9q4uo0v5l/3ygr:KRYnpQWga611QEbw9q4uo0v5lvH

Score

10^/10

defense_evasion discovery

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 10 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\svchost.exe = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe:*:Enabled:Windows Messanger"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
4776	reg.exe
4024	reg.exe
224	reg.exe
4544	reg.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: 1	1524	JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe
Token: SeCreateTokenPrivilege	1524	JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe
Token: SeAssignPrimaryTokenPrivilege	1524	JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe
Token: SeLockMemoryPrivilege	1524	JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe
Token: SeIncreaseQuotaPrivilege	1524	JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe
Token: SeMachineAccountPrivilege	1524	JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe
Token: SeTcbPrivilege	1524	JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe
Token: SeSecurityPrivilege	1524	JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe
Token: SeTakeOwnershipPrivilege	1524	JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe
Token: SeLoadDriverPrivilege	1524	JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe
Token: SeSystemProfilePrivilege	1524	JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe
Token: SeSystemtimePrivilege	1524	JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe
Token: SeProfSingleProcessPrivilege	1524	JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe
Token: SeIncBasePriorityPrivilege	1524	JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe
Token: SeCreatePagefilePrivilege	1524	JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe
Token: SeCreatePermanentPrivilege	1524	JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe
Token: SeBackupPrivilege	1524	JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe
Token: SeRestorePrivilege	1524	JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe
Token: SeShutdownPrivilege	1524	JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe
Token: SeDebugPrivilege	1524	JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe
Token: SeAuditPrivilege	1524	JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe
Token: SeSystemEnvironmentPrivilege	1524	JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe
Token: SeChangeNotifyPrivilege	1524	JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe
Token: SeRemoteShutdownPrivilege	1524	JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe
Token: SeUndockPrivilege	1524	JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe
Token: SeSyncAgentPrivilege	1524	JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe
Token: SeEnableDelegationPrivilege	1524	JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe
Token: SeManageVolumePrivilege	1524	JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe
Token: SeImpersonatePrivilege	1524	JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe
Token: SeCreateGlobalPrivilege	1524	JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe
Token: 31	1524	JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe
Token: 32	1524	JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe
Token: 33	1524	JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe
Token: 34	1524	JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe
Token: 35	1524	JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1524	JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe
1524	JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe
1524	JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1524 wrote to memory of 3348	1524	JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe	85
PID 1524 wrote to memory of 3348	1524	JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe	85
PID 1524 wrote to memory of 3348	1524	JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe	85
PID 1524 wrote to memory of 3448	1524	JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe	86
PID 1524 wrote to memory of 3448	1524	JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe	86
PID 1524 wrote to memory of 3448	1524	JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe	86
PID 1524 wrote to memory of 1748	1524	JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe	87
PID 1524 wrote to memory of 1748	1524	JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe	87
PID 1524 wrote to memory of 1748	1524	JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe	87
PID 1524 wrote to memory of 5032	1524	JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe	88
PID 1524 wrote to memory of 5032	1524	JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe	88
PID 1524 wrote to memory of 5032	1524	JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe	88
PID 3448 wrote to memory of 4776	3448	cmd.exe	93
PID 3448 wrote to memory of 4776	3448	cmd.exe	93
PID 3448 wrote to memory of 4776	3448	cmd.exe	93
PID 5032 wrote to memory of 4024	5032	cmd.exe	95
PID 5032 wrote to memory of 4024	5032	cmd.exe	95
PID 5032 wrote to memory of 4024	5032	cmd.exe	95
PID 1748 wrote to memory of 224	1748	cmd.exe	96
PID 1748 wrote to memory of 224	1748	cmd.exe	96
PID 1748 wrote to memory of 224	1748	cmd.exe	96
PID 3348 wrote to memory of 4544	3348	cmd.exe	97
PID 3348 wrote to memory of 4544	3348	cmd.exe	97
PID 3348 wrote to memory of 4544	3348	cmd.exe	97

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3348
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - Modifies firewall policy service
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4544
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe:*:Enabled:Windows Messanger" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3448
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6fbc6ed2d1570ec735bb8a5b6cd124e9.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - Modifies firewall policy service
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4776
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1748
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - Modifies firewall policy service
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:224
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe:*:Enabled:Windows Messanger" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5032
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - Modifies firewall policy service
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4024