Analysis
-
max time kernel
147s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20250207-en -
resource tags
arch:x64arch:x86image:win7-20250207-enlocale:en-usos:windows7-x64system -
submitted
29/03/2025, 20:09
Behavioral task
behavioral1
Sample
JaffaCakes118_97226907a3d10449469e99f7e387f0fe.exe
Resource
win7-20250207-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
JaffaCakes118_97226907a3d10449469e99f7e387f0fe.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
JaffaCakes118_97226907a3d10449469e99f7e387f0fe.exe
-
Size
488KB
-
MD5
97226907a3d10449469e99f7e387f0fe
-
SHA1
4d1f100ce61ba5f19f6ad400e94351de7506e6ae
-
SHA256
638c64668cca58e58bf550312307e80d8f4f91e4275f47c7fe645daae47bb8ac
-
SHA512
803f6eee2d1997e79afb3695a78933924cae9d499d241b4cef6171b0b814fcb0a5ffc80eb988d4ebd43a211da5234bab01ea903a6e86cde53153802b856f130e
-
SSDEEP
6144:k7piDN+S7md4UBHng5Ha/xrV8vJBQISKMqK/RPQGRc3+vLrKAq6Oe:KUD1m+YgatSbnMqK/RPQGRc3+vXy6Oe
Score
10/10
Malware Config
Signatures
-
Modifies firewall policy service 3 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_97226907a3d10449469e99f7e387f0fe.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\JaffaCakes118_97226907a3d10449469e99f7e387f0fe.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\local.exe = "C:\\Users\\Admin\\AppData\\Roaming\\local.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_97226907a3d10449469e99f7e387f0fe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 1780 reg.exe 2200 reg.exe 2060 reg.exe 2148 reg.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: 1 2328 JaffaCakes118_97226907a3d10449469e99f7e387f0fe.exe Token: SeCreateTokenPrivilege 2328 JaffaCakes118_97226907a3d10449469e99f7e387f0fe.exe Token: SeAssignPrimaryTokenPrivilege 2328 JaffaCakes118_97226907a3d10449469e99f7e387f0fe.exe Token: SeLockMemoryPrivilege 2328 JaffaCakes118_97226907a3d10449469e99f7e387f0fe.exe Token: SeIncreaseQuotaPrivilege 2328 JaffaCakes118_97226907a3d10449469e99f7e387f0fe.exe Token: SeMachineAccountPrivilege 2328 JaffaCakes118_97226907a3d10449469e99f7e387f0fe.exe Token: SeTcbPrivilege 2328 JaffaCakes118_97226907a3d10449469e99f7e387f0fe.exe Token: SeSecurityPrivilege 2328 JaffaCakes118_97226907a3d10449469e99f7e387f0fe.exe Token: SeTakeOwnershipPrivilege 2328 JaffaCakes118_97226907a3d10449469e99f7e387f0fe.exe Token: SeLoadDriverPrivilege 2328 JaffaCakes118_97226907a3d10449469e99f7e387f0fe.exe Token: SeSystemProfilePrivilege 2328 JaffaCakes118_97226907a3d10449469e99f7e387f0fe.exe Token: SeSystemtimePrivilege 2328 JaffaCakes118_97226907a3d10449469e99f7e387f0fe.exe Token: SeProfSingleProcessPrivilege 2328 JaffaCakes118_97226907a3d10449469e99f7e387f0fe.exe Token: SeIncBasePriorityPrivilege 2328 JaffaCakes118_97226907a3d10449469e99f7e387f0fe.exe Token: SeCreatePagefilePrivilege 2328 JaffaCakes118_97226907a3d10449469e99f7e387f0fe.exe Token: SeCreatePermanentPrivilege 2328 JaffaCakes118_97226907a3d10449469e99f7e387f0fe.exe Token: SeBackupPrivilege 2328 JaffaCakes118_97226907a3d10449469e99f7e387f0fe.exe Token: SeRestorePrivilege 2328 JaffaCakes118_97226907a3d10449469e99f7e387f0fe.exe Token: SeShutdownPrivilege 2328 JaffaCakes118_97226907a3d10449469e99f7e387f0fe.exe Token: SeDebugPrivilege 2328 JaffaCakes118_97226907a3d10449469e99f7e387f0fe.exe Token: SeAuditPrivilege 2328 JaffaCakes118_97226907a3d10449469e99f7e387f0fe.exe Token: SeSystemEnvironmentPrivilege 2328 JaffaCakes118_97226907a3d10449469e99f7e387f0fe.exe Token: SeChangeNotifyPrivilege 2328 JaffaCakes118_97226907a3d10449469e99f7e387f0fe.exe Token: SeRemoteShutdownPrivilege 2328 JaffaCakes118_97226907a3d10449469e99f7e387f0fe.exe Token: SeUndockPrivilege 2328 JaffaCakes118_97226907a3d10449469e99f7e387f0fe.exe Token: SeSyncAgentPrivilege 2328 JaffaCakes118_97226907a3d10449469e99f7e387f0fe.exe Token: SeEnableDelegationPrivilege 2328 JaffaCakes118_97226907a3d10449469e99f7e387f0fe.exe Token: SeManageVolumePrivilege 2328 JaffaCakes118_97226907a3d10449469e99f7e387f0fe.exe Token: SeImpersonatePrivilege 2328 JaffaCakes118_97226907a3d10449469e99f7e387f0fe.exe Token: SeCreateGlobalPrivilege 2328 JaffaCakes118_97226907a3d10449469e99f7e387f0fe.exe Token: 31 2328 JaffaCakes118_97226907a3d10449469e99f7e387f0fe.exe Token: 32 2328 JaffaCakes118_97226907a3d10449469e99f7e387f0fe.exe Token: 33 2328 JaffaCakes118_97226907a3d10449469e99f7e387f0fe.exe Token: 34 2328 JaffaCakes118_97226907a3d10449469e99f7e387f0fe.exe Token: 35 2328 JaffaCakes118_97226907a3d10449469e99f7e387f0fe.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2328 JaffaCakes118_97226907a3d10449469e99f7e387f0fe.exe 2328 JaffaCakes118_97226907a3d10449469e99f7e387f0fe.exe 2328 JaffaCakes118_97226907a3d10449469e99f7e387f0fe.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 2328 wrote to memory of 2236 2328 JaffaCakes118_97226907a3d10449469e99f7e387f0fe.exe 31 PID 2328 wrote to memory of 2236 2328 JaffaCakes118_97226907a3d10449469e99f7e387f0fe.exe 31 PID 2328 wrote to memory of 2236 2328 JaffaCakes118_97226907a3d10449469e99f7e387f0fe.exe 31 PID 2328 wrote to memory of 2236 2328 JaffaCakes118_97226907a3d10449469e99f7e387f0fe.exe 31 PID 2328 wrote to memory of 1316 2328 JaffaCakes118_97226907a3d10449469e99f7e387f0fe.exe 32 PID 2328 wrote to memory of 1316 2328 JaffaCakes118_97226907a3d10449469e99f7e387f0fe.exe 32 PID 2328 wrote to memory of 1316 2328 JaffaCakes118_97226907a3d10449469e99f7e387f0fe.exe 32 PID 2328 wrote to memory of 1316 2328 JaffaCakes118_97226907a3d10449469e99f7e387f0fe.exe 32 PID 2328 wrote to memory of 1600 2328 JaffaCakes118_97226907a3d10449469e99f7e387f0fe.exe 34 PID 2328 wrote to memory of 1600 2328 JaffaCakes118_97226907a3d10449469e99f7e387f0fe.exe 34 PID 2328 wrote to memory of 1600 2328 JaffaCakes118_97226907a3d10449469e99f7e387f0fe.exe 34 PID 2328 wrote to memory of 1600 2328 JaffaCakes118_97226907a3d10449469e99f7e387f0fe.exe 34 PID 2328 wrote to memory of 2268 2328 JaffaCakes118_97226907a3d10449469e99f7e387f0fe.exe 35 PID 2328 wrote to memory of 2268 2328 JaffaCakes118_97226907a3d10449469e99f7e387f0fe.exe 35 PID 2328 wrote to memory of 2268 2328 JaffaCakes118_97226907a3d10449469e99f7e387f0fe.exe 35 PID 2328 wrote to memory of 2268 2328 JaffaCakes118_97226907a3d10449469e99f7e387f0fe.exe 35 PID 2236 wrote to memory of 1780 2236 cmd.exe 39 PID 2236 wrote to memory of 1780 2236 cmd.exe 39 PID 2236 wrote to memory of 1780 2236 cmd.exe 39 PID 2236 wrote to memory of 1780 2236 cmd.exe 39 PID 1316 wrote to memory of 2200 1316 cmd.exe 40 PID 1316 wrote to memory of 2200 1316 cmd.exe 40 PID 1316 wrote to memory of 2200 1316 cmd.exe 40 PID 1316 wrote to memory of 2200 1316 cmd.exe 40 PID 2268 wrote to memory of 2060 2268 cmd.exe 41 PID 2268 wrote to memory of 2060 2268 cmd.exe 41 PID 2268 wrote to memory of 2060 2268 cmd.exe 41 PID 2268 wrote to memory of 2060 2268 cmd.exe 41 PID 1600 wrote to memory of 2148 1600 cmd.exe 42 PID 1600 wrote to memory of 2148 1600 cmd.exe 42 PID 1600 wrote to memory of 2148 1600 cmd.exe 42 PID 1600 wrote to memory of 2148 1600 cmd.exe 42
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_97226907a3d10449469e99f7e387f0fe.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_97226907a3d10449469e99f7e387f0fe.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:1780
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_97226907a3d10449469e99f7e387f0fe.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_97226907a3d10449469e99f7e387f0fe.exe:*:Enabled:Windows Messanger" /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_97226907a3d10449469e99f7e387f0fe.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_97226907a3d10449469e99f7e387f0fe.exe:*:Enabled:Windows Messanger" /f3⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2200
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2148
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\local.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\local.exe:*:Enabled:Windows Messanger" /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\local.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\local.exe:*:Enabled:Windows Messanger" /f3⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2060
-
-