Analysis
-
max time kernel
79s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
13/03/2025, 09:24
Behavioral task
behavioral1
Sample
JaffaCakes118_6ff88b3a8c49d3dc410c43abcf46e3c6.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
JaffaCakes118_6ff88b3a8c49d3dc410c43abcf46e3c6.exe
Resource
win10v2004-20250217-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
JaffaCakes118_6ff88b3a8c49d3dc410c43abcf46e3c6.exe
-
Size
32KB
-
MD5
6ff88b3a8c49d3dc410c43abcf46e3c6
-
SHA1
7f543edab67949481508589d7d0100b9355e4658
-
SHA256
2e59ddf2b3e768eb00855b1d0dcb582539cfc9293f2e98c8a89251f75d37fc1e
-
SHA512
5d7b14c56ea2c54adf7681eaff372eecc50244dbbbeca554ea1ce7b09dcc82f4f74cb6fa63fee201b7b9a09289acb55f388e3e01b958503823da69e20b3e54ac
-
SSDEEP
768:fQMt97o9Uef8q2/0GU/Fq37w1aJmOWjQz9ZXWJjkJXo/5:J989UGm8GUELw16cJjkJs
Score
8/10
Malware Config
Signatures
-
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kpfwsvc.exe\debugger = "SvchoSt.exe" JaffaCakes118_6ff88b3a8c49d3dc410c43abcf46e3c6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvsrvxp.exe\debugger = "SvchoSt.exe" JaffaCakes118_6ff88b3a8c49d3dc410c43abcf46e3c6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\McShield.exe\debugger = "SvchoSt.exe" JaffaCakes118_6ff88b3a8c49d3dc410c43abcf46e3c6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMonD.exe\debugger = "SvchoSt.exe" JaffaCakes118_6ff88b3a8c49d3dc410c43abcf46e3c6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCenter.exe JaffaCakes118_6ff88b3a8c49d3dc410c43abcf46e3c6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe\debugger = "SvchoSt.exe" JaffaCakes118_6ff88b3a8c49d3dc410c43abcf46e3c6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVPFW.exe JaffaCakes118_6ff88b3a8c49d3dc410c43abcf46e3c6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVPFW.exe\debugger = "SvchoSt.exe" JaffaCakes118_6ff88b3a8c49d3dc410c43abcf46e3c6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvmonxp.exe JaffaCakes118_6ff88b3a8c49d3dc410c43abcf46e3c6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\McShield.exe JaffaCakes118_6ff88b3a8c49d3dc410c43abcf46e3c6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ast.exe JaffaCakes118_6ff88b3a8c49d3dc410c43abcf46e3c6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwsrv.exe JaffaCakes118_6ff88b3a8c49d3dc410c43abcf46e3c6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwstub.exe\debugger = "SvchoSt.exe" JaffaCakes118_6ff88b3a8c49d3dc410c43abcf46e3c6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kwatch.exe JaffaCakes118_6ff88b3a8c49d3dc410c43abcf46e3c6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kwatch.exe\debugger = "SvchoSt.exe" JaffaCakes118_6ff88b3a8c49d3dc410c43abcf46e3c6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kpfw32.exe JaffaCakes118_6ff88b3a8c49d3dc410c43abcf46e3c6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ast.exe\debugger = "SvchoSt.exe" JaffaCakes118_6ff88b3a8c49d3dc410c43abcf46e3c6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\guard.exe JaffaCakes118_6ff88b3a8c49d3dc410c43abcf46e3c6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safe.exe JaffaCakes118_6ff88b3a8c49d3dc410c43abcf46e3c6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe JaffaCakes118_6ff88b3a8c49d3dc410c43abcf46e3c6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMon.exe JaffaCakes118_6ff88b3a8c49d3dc410c43abcf46e3c6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMonD.exe JaffaCakes118_6ff88b3a8c49d3dc410c43abcf46e3c6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCenter.exe\debugger = "SvchoSt.exe" JaffaCakes118_6ff88b3a8c49d3dc410c43abcf46e3c6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwProxy.exe JaffaCakes118_6ff88b3a8c49d3dc410c43abcf46e3c6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwProxy.exe\debugger = "SvchoSt.exe" JaffaCakes118_6ff88b3a8c49d3dc410c43abcf46e3c6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\guard.exe\debugger = "SvchoSt.exe" JaffaCakes118_6ff88b3a8c49d3dc410c43abcf46e3c6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwstub.exe JaffaCakes118_6ff88b3a8c49d3dc410c43abcf46e3c6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kasmain.exe JaffaCakes118_6ff88b3a8c49d3dc410c43abcf46e3c6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvsrvxp.exe JaffaCakes118_6ff88b3a8c49d3dc410c43abcf46e3c6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wmain.exe\debugger = "SvchoSt.exe" JaffaCakes118_6ff88b3a8c49d3dc410c43abcf46e3c6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvmonxp.exe\debugger = "SvchoSt.exe" JaffaCakes118_6ff88b3a8c49d3dc410c43abcf46e3c6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe JaffaCakes118_6ff88b3a8c49d3dc410c43abcf46e3c6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavStub.exe JaffaCakes118_6ff88b3a8c49d3dc410c43abcf46e3c6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavStub.exe\debugger = "SvchoSt.exe" JaffaCakes118_6ff88b3a8c49d3dc410c43abcf46e3c6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwsrv.exe\debugger = "SvchoSt.exe" JaffaCakes118_6ff88b3a8c49d3dc410c43abcf46e3c6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe JaffaCakes118_6ff88b3a8c49d3dc410c43abcf46e3c6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safe.exe\debugger = "SvchoSt.exe" JaffaCakes118_6ff88b3a8c49d3dc410c43abcf46e3c6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safebox.exe JaffaCakes118_6ff88b3a8c49d3dc410c43abcf46e3c6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kpfw32.exe\debugger = "SvchoSt.exe" JaffaCakes118_6ff88b3a8c49d3dc410c43abcf46e3c6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMon.exe\debugger = "SvchoSt.exe" JaffaCakes118_6ff88b3a8c49d3dc410c43abcf46e3c6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavTask.exe JaffaCakes118_6ff88b3a8c49d3dc410c43abcf46e3c6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe\debugger = "SvchoSt.exe" JaffaCakes118_6ff88b3a8c49d3dc410c43abcf46e3c6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safebox.exe\debugger = "SvchoSt.exe" JaffaCakes118_6ff88b3a8c49d3dc410c43abcf46e3c6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kpfwsvc.exe JaffaCakes118_6ff88b3a8c49d3dc410c43abcf46e3c6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kasmain.exe\debugger = "SvchoSt.exe" JaffaCakes118_6ff88b3a8c49d3dc410c43abcf46e3c6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvprescan.exe JaffaCakes118_6ff88b3a8c49d3dc410c43abcf46e3c6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvprescan.exe\debugger = "SvchoSt.exe" JaffaCakes118_6ff88b3a8c49d3dc410c43abcf46e3c6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavTask.exe\debugger = "SvchoSt.exe" JaffaCakes118_6ff88b3a8c49d3dc410c43abcf46e3c6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wmain.exe JaffaCakes118_6ff88b3a8c49d3dc410c43abcf46e3c6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe JaffaCakes118_6ff88b3a8c49d3dc410c43abcf46e3c6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe\debugger = "SvchoSt.exe" JaffaCakes118_6ff88b3a8c49d3dc410c43abcf46e3c6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe\debugger = "SvchoSt.exe" JaffaCakes118_6ff88b3a8c49d3dc410c43abcf46e3c6.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\dll.exe JaffaCakes118_6ff88b3a8c49d3dc410c43abcf46e3c6.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_6ff88b3a8c49d3dc410c43abcf46e3c6.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2876 JaffaCakes118_6ff88b3a8c49d3dc410c43abcf46e3c6.exe 2876 JaffaCakes118_6ff88b3a8c49d3dc410c43abcf46e3c6.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 676 Process not Found -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2876 JaffaCakes118_6ff88b3a8c49d3dc410c43abcf46e3c6.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2876 JaffaCakes118_6ff88b3a8c49d3dc410c43abcf46e3c6.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6ff88b3a8c49d3dc410c43abcf46e3c6.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6ff88b3a8c49d3dc410c43abcf46e3c6.exe"1⤵
- Event Triggered Execution: Image File Execution Options Injection
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
PID:2876