Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
31-03-2024 04:18
General
-
Target
4cea5d8cb3e0a17e942812e31667120a_JaffaCakes118.msi
-
Size
124KB
-
MD5
4cea5d8cb3e0a17e942812e31667120a
-
SHA1
c526373cc21495053cdf3ff735f10e4f031659b7
-
SHA256
be4448eb3e5f348051538b82b3e9b63191da49d028e6c5f2b8de4cbc6135c84a
-
SHA512
1eed5b3fa630ca2e4998e5eae400cab82a2e65005107f9bae0ae04a7ed7b32373ffaaf486578acca13bf74c38193e62fbb51da381555fec8d45c10a40cc962f7
-
SSDEEP
1536:LEuul/7WYt61BPnueWzlCd46+Ml3ybnWbHPs:LEu4/7Rt61BPue4+46+s5HE
Malware Config
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Checks QEMU agent file 2 TTPs 2 IoCs
Checks presence of QEMU agent, possibly to detect virtualization.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Drops file in Windows directory 8 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 55 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\4cea5d8cb3e0a17e942812e31667120a_JaffaCakes118.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Installer\MSI72DF.tmp"C:\Windows\Installer\MSI72DF.tmp"2⤵
- Checks QEMU agent file
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Executes dropped EXE
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Installer\MSI72DF.tmp"C:\Windows\Installer\MSI72DF.tmp"3⤵
- Checks QEMU agent file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Loads dropped DLL
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Config.Msi\e577206.rbsFilesize
663B
MD56941d285f50cc352f2ef6d1a92059282
SHA109802f1a59594e1e2fcf67bdcdaa32af7bf936c9
SHA2568e13ab22382cd55fee388847d7436fa01798687786c7fd4d59501a178fc26d18
SHA512c41639bcfc110886f8fdb4925782fe88ef7746651733939fd96b3841770adfbaef9b5e12e04ea21a65ff7a024ec04830f607e24968d928d824372895154f027b
-
C:\Windows\Installer\MSI72DF.tmpFilesize
100KB
MD59c0f4f8b74d0c49c28997dcc175897c9
SHA156aedf510fe21edf7f5deb00b210e50f54f44443
SHA2569fd8a479a9f54341cfea3c2906cbc779c8623a288708ac00e21a486f325e3934
SHA512c2ff13b0737904fc97fdd57a17f9d4885776a5c07d1c3a884292e7143df2966397e4f4820a39450c950b2e3c68fdf2799091357fa9f129ef196e962f4c5e8ba3
-
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2Filesize
23.0MB
MD5483f6226d4fb727afd0670635ae45950
SHA1d72844e5e8e8bac6e5b5569f64ccb4f323cfabda
SHA256eeb6c21017b91422803d5c5252d4cedb2213add200ca43a3b5a84b5bf278af5d
SHA512db098b1188652eb6c841398b1f66978e6d3a56c435b673ab333e32517c02107403bef7329b0cc126fbdc0aa325a4c42655bd7ed0494409f1bec5a91d3979a9d2
-
\??\Volume{14f6f45c-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{70287e1a-ce4f-448e-992c-099ef00f1976}_OnDiskSnapshotPropFilesize
6KB
MD581dd8bd27eb2d1d85cfd3f5167bb0521
SHA1f224b216184ba2e5ba3016e2e324acd98f3b2e45
SHA256bf0bd408e936ae10d04ff88f4035abd256e20a10cf44f19629911d1a8c3580e7
SHA5126c406897612279ad293f73af9cd0ce0da100bda513402d5ce1a0635c8e10d7f91f46b8176aa15f46b734e10855ad075932f3fe91d82bc04fbef46719c7a0ba2f
-
memory/1728-14-0x0000000000750000-0x0000000000761000-memory.dmpFilesize
68KB
-
memory/1728-15-0x0000000077201000-0x0000000077321000-memory.dmpFilesize
1.1MB
-
memory/1728-21-0x0000000000750000-0x0000000000761000-memory.dmpFilesize
68KB
-
memory/2552-19-0x0000000000400000-0x000000000055D000-memory.dmpFilesize
1.4MB
-
memory/2552-22-0x0000000000560000-0x0000000000660000-memory.dmpFilesize
1024KB
-
memory/2552-35-0x0000000000400000-0x000000000055D000-memory.dmpFilesize
1.4MB
-
memory/2552-37-0x0000000000560000-0x0000000000660000-memory.dmpFilesize
1024KB