Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20251218-en - resource tags
arch:x64arch:x86image:win11-20251218-enlocale:en-usos:windows11-21h2-x64system - submitted
21/12/2025, 16:45
Behavioral task
behavioral1
Sample
JaffaCakes118_3c6f18f78a4288f8d58390b9b2910cc1.exe
Resource
win10v2004-20251218-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
JaffaCakes118_3c6f18f78a4288f8d58390b9b2910cc1.exe
Resource
win11-20251218-en
windows11-21h2-x64
12 signatures
150 seconds
General
- Target JaffaCakes118_3c6f18f78a4288f8d58390b9b2910cc1.exe
- Size 459KB
- Sample251221-t9mt7strdx
- SHA256 aa6c18f7bbd7e1fd072d97e0880d597d568171e0757226d7fbc5e983205729a4
- MD5 3c6f18f78a4288f8d58390b9b2910cc1
- SHA1 b6e37236f5a6ee474b1691253d73f9b558333a56
- SHA512 10e1d95827830b65af809081544017b05eba3bd2acb8d687b4815a8e9813a78df85ed88aa34061d1605af00b0f2c54c3eecf3cf5b28a1e3cf377899ae9be233b
- SSDEEP 6144:EtzTdR5XkNq80PzW+Io1HySsWWoA0gTRrm8dEaJq0OMBVgWwAidpNCgrBF:izTJbAodco3gTksJqmVgWwAkAQ
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detects Fasong 1 IoCs
resource yara_rule behavioral2/files/0x001a00000002b23b-12.dat family_fasong - Fasong family
-
resource yara_rule behavioral2/files/0x001900000002b23e-18.dat aspack_v212_v242 - Loads dropped DLL 2 IoCs
pid Process 2320 Regsvr32.exe 2320 Regsvr32.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SQUTT.EXE = "C:\\System Volume Information\\svchost.exe" JaffaCakes118_3c6f18f78a4288f8d58390b9b2910cc1.exe - Enumerates connected drives 3 TTPs 17 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: JaffaCakes118_3c6f18f78a4288f8d58390b9b2910cc1.exe File opened (read-only) \??\H: JaffaCakes118_3c6f18f78a4288f8d58390b9b2910cc1.exe File opened (read-only) \??\L: JaffaCakes118_3c6f18f78a4288f8d58390b9b2910cc1.exe File opened (read-only) \??\O: JaffaCakes118_3c6f18f78a4288f8d58390b9b2910cc1.exe File opened (read-only) \??\P: JaffaCakes118_3c6f18f78a4288f8d58390b9b2910cc1.exe File opened (read-only) \??\R: JaffaCakes118_3c6f18f78a4288f8d58390b9b2910cc1.exe File opened (read-only) \??\T: JaffaCakes118_3c6f18f78a4288f8d58390b9b2910cc1.exe File opened (read-only) \??\N: JaffaCakes118_3c6f18f78a4288f8d58390b9b2910cc1.exe File opened (read-only) \??\S: JaffaCakes118_3c6f18f78a4288f8d58390b9b2910cc1.exe File opened (read-only) \??\U: JaffaCakes118_3c6f18f78a4288f8d58390b9b2910cc1.exe File opened (read-only) \??\M: JaffaCakes118_3c6f18f78a4288f8d58390b9b2910cc1.exe File opened (read-only) \??\I: JaffaCakes118_3c6f18f78a4288f8d58390b9b2910cc1.exe File opened (read-only) \??\J: JaffaCakes118_3c6f18f78a4288f8d58390b9b2910cc1.exe File opened (read-only) \??\K: JaffaCakes118_3c6f18f78a4288f8d58390b9b2910cc1.exe File opened (read-only) \??\Q: JaffaCakes118_3c6f18f78a4288f8d58390b9b2910cc1.exe File opened (read-only) \??\V: JaffaCakes118_3c6f18f78a4288f8d58390b9b2910cc1.exe File opened (read-only) \??\E: JaffaCakes118_3c6f18f78a4288f8d58390b9b2910cc1.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\SQUTT.EXE JaffaCakes118_3c6f18f78a4288f8d58390b9b2910cc1.exe File created C:\Windows\SysWOW64\Ms7002.dll JaffaCakes118_3c6f18f78a4288f8d58390b9b2910cc1.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_3c6f18f78a4288f8d58390b9b2910cc1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Regsvr32.exe - Modifies registry class 31 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command JaffaCakes118_3c6f18f78a4288f8d58390b9b2910cc1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile JaffaCakes118_3c6f18f78a4288f8d58390b9b2910cc1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open JaffaCakes118_3c6f18f78a4288f8d58390b9b2910cc1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell JaffaCakes118_3c6f18f78a4288f8d58390b9b2910cc1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\QPWorkFile JaffaCakes118_3c6f18f78a4288f8d58390b9b2910cc1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command JaffaCakes118_3c6f18f78a4288f8d58390b9b2910cc1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command\ = "C:\\$Recycle.Bin\\KER.EXE \"%1\"" JaffaCakes118_3c6f18f78a4288f8d58390b9b2910cc1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7CD4138D-4147-420B-9749-00A13B526785}\InprocServer32 Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Ms7002.ShellExecuteHook\Clsid\ = "{7CD4138D-4147-420B-9749-00A13B526785}" Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file JaffaCakes118_3c6f18f78a4288f8d58390b9b2910cc1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inifile\shell\open JaffaCakes118_3c6f18f78a4288f8d58390b9b2910cc1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\QPWorkFile\qp7002 = "C:\\Windows\\SysWow64\\SQUTT.EXE" JaffaCakes118_3c6f18f78a4288f8d58390b9b2910cc1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7CD4138D-4147-420B-9749-00A13B526785} Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Ms7002.ShellExecuteHook\ = "MaiHook7002" Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7CD4138D-4147-420B-9749-00A13B526785}\ProgID Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command JaffaCakes118_3c6f18f78a4288f8d58390b9b2910cc1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7CD4138D-4147-420B-9749-00A13B526785}\InprocServer32\ThreadingModel = "Apartment" Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\$Recycle.Bin\\KER.EXE %1" JaffaCakes118_3c6f18f78a4288f8d58390b9b2910cc1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inifile JaffaCakes118_3c6f18f78a4288f8d58390b9b2910cc1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inifile\shell\open\command\ = "C:\\$Recycle.Bin\\KER.EXE %1" JaffaCakes118_3c6f18f78a4288f8d58390b9b2910cc1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7CD4138D-4147-420B-9749-00A13B526785}\ = "MaiHook7002" Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell JaffaCakes118_3c6f18f78a4288f8d58390b9b2910cc1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell\open\command JaffaCakes118_3c6f18f78a4288f8d58390b9b2910cc1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inifile\shell JaffaCakes118_3c6f18f78a4288f8d58390b9b2910cc1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Ms7002.ShellExecuteHook Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Ms7002.ShellExecuteHook\Clsid Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7CD4138D-4147-420B-9749-00A13B526785}\ProgID\ = "Ms7002.ShellExecuteHook" Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell\open JaffaCakes118_3c6f18f78a4288f8d58390b9b2910cc1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command\ = "C:\\$Recycle.Bin\\KER.EXE \"%1\"" JaffaCakes118_3c6f18f78a4288f8d58390b9b2910cc1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inifile\shell\open\command JaffaCakes118_3c6f18f78a4288f8d58390b9b2910cc1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7CD4138D-4147-420B-9749-00A13B526785}\InprocServer32\ = "C:\\Windows\\SysWow64\\Ms7002.dll" Regsvr32.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4388 JaffaCakes118_3c6f18f78a4288f8d58390b9b2910cc1.exe 4388 JaffaCakes118_3c6f18f78a4288f8d58390b9b2910cc1.exe 4388 JaffaCakes118_3c6f18f78a4288f8d58390b9b2910cc1.exe 4388 JaffaCakes118_3c6f18f78a4288f8d58390b9b2910cc1.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4388 wrote to memory of 2320 4388 JaffaCakes118_3c6f18f78a4288f8d58390b9b2910cc1.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3c6f18f78a4288f8d58390b9b2910cc1.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3c6f18f78a4288f8d58390b9b2910cc1.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Windows\SysWOW64\Regsvr32.exeRegsvr32.exe C:\Windows\system32\Ms7002.dll /s2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2320
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\KER.EXE
- Size 459KB
- SHA256 4f538301ec3939ff4fd5d958ecd323aa55cdf62ef512a0f5899bb829ef9fb7b6
- MD5 361e4924548c5eee5d3d5cb0f6a78772
- SHA1 dd59d753a7c28c66aa9930b85b93579a33913e22
- SHA512 363fbf08aa2304e6326e5f922aa8983799c8f985519c7484358d1b20eef70f4d9010539feed2cd6bff776b2b94ec44c8cd5ab9224275bcb5cb4ad95dbe24b7a6
- SSDEEP 6144:EtzTdR5XkNq80PzW+Io1HySsWWoA0gTRrm8dEaJq0OMBVgWwAidpNCgrBF:izTJbAodco3gTksJqmVgWwAkAQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Ms7002.dll
- Size 52KB
- SHA256 f0a7ec2edff7699e546221808f45ca8816a75eb519618283d7c4514dfb9134e0
- MD5 876a2a99b81968f5b26e3cbe12063d2b
- SHA1 7afa8f33b691b2651b65eb07220cc2fda4b7537c
- SHA512 ca0574dbb5ff4b146679ffc38aa794e64470949cd228518d04d3680d63a1ce2f076e38494fa5b6cd0722c2dc3e35c5b5c3b63483c1fa7dc62bca42c4cf8e0ce1
- SSDEEP 1536:riGsIaW7ZyAiXYtkpN/+lIbEGjaussBUoh:riGsIaWwAiXNpN/+eEP9S5h
- MD5 SHA1 SHA512 SSDEEP