Analysis
- max time kernel
146s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
31/03/2024, 04:18
Static task
static1
Behavioral task
behavioral1
Sample
4cea5d8cb3e0a17e942812e31667120a_JaffaCakes118.msi
Resource
win7-20231129-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
4cea5d8cb3e0a17e942812e31667120a_JaffaCakes118.msi
Resource
win10v2004-20231215-en
windows10-2004-x64
17 signatures
150 seconds
General
- Target 4cea5d8cb3e0a17e942812e31667120a_JaffaCakes118.msi
- Size 124KB
- Sample240331-exfg2adf6v
- SHA256 be4448eb3e5f348051538b82b3e9b63191da49d028e6c5f2b8de4cbc6135c84a
- MD5 4cea5d8cb3e0a17e942812e31667120a
- SHA1 c526373cc21495053cdf3ff735f10e4f031659b7
- SHA512 1eed5b3fa630ca2e4998e5eae400cab82a2e65005107f9bae0ae04a7ed7b32373ffaaf486578acca13bf74c38193e62fbb51da381555fec8d45c10a40cc962f7
- SSDEEP 1536:LEuul/7WYt61BPnueWzlCd46+Ml3ybnWbHPs:LEu4/7Rt61BPue4+46+s5HE
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
- Checks QEMU agent file 2 TTPs 2 IoCs
Checks presence of QEMU agent, possibly to detect virtualization.
description ioc Process File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe MSI72DF.tmp File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe MSI72DF.tmp - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\PANTOPTEROUS = "C:\\Users\\Admin\\AppData\\Local\\Temp\\AGONIED\\KLUMSEDE.vbs" MSI72DF.tmp - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\J: msiexec.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 1728 MSI72DF.tmp 2552 MSI72DF.tmp - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1728 set thread context of 2552 1728 MSI72DF.tmp 100 - Drops file in Windows directory 8 IoCs
description ioc Process File created C:\Windows\Installer\SourceHash{29EF7317-DCA1-4159-97B2-C883AD400AC6} msiexec.exe File opened for modification C:\Windows\Installer\MSI7290.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI72DF.tmp msiexec.exe File created C:\Windows\Installer\e577203.msi msiexec.exe File opened for modification C:\Windows\Installer\e577203.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe - Executes dropped EXE 1 IoCs
pid Process 1728 MSI72DF.tmp - Loads dropped DLL 1 IoCs
pid Process 2552 MSI72DF.tmp - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000005cf4f6141e81f6580000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800005cf4f6140000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809005cf4f614000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d5cf4f614000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000005cf4f61400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4276 msiexec.exe 4276 msiexec.exe - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1728 MSI72DF.tmp - Suspicious use of AdjustPrivilegeToken 55 IoCs
description pid Process Token: SeShutdownPrivilege 1116 msiexec.exe Token: SeIncreaseQuotaPrivilege 1116 msiexec.exe Token: SeSecurityPrivilege 4276 msiexec.exe Token: SeCreateTokenPrivilege 1116 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1116 msiexec.exe Token: SeLockMemoryPrivilege 1116 msiexec.exe Token: SeIncreaseQuotaPrivilege 1116 msiexec.exe Token: SeMachineAccountPrivilege 1116 msiexec.exe Token: SeTcbPrivilege 1116 msiexec.exe Token: SeSecurityPrivilege 1116 msiexec.exe Token: SeTakeOwnershipPrivilege 1116 msiexec.exe Token: SeLoadDriverPrivilege 1116 msiexec.exe Token: SeSystemProfilePrivilege 1116 msiexec.exe Token: SeSystemtimePrivilege 1116 msiexec.exe Token: SeProfSingleProcessPrivilege 1116 msiexec.exe Token: SeIncBasePriorityPrivilege 1116 msiexec.exe Token: SeCreatePagefilePrivilege 1116 msiexec.exe Token: SeCreatePermanentPrivilege 1116 msiexec.exe Token: SeBackupPrivilege 1116 msiexec.exe Token: SeRestorePrivilege 1116 msiexec.exe Token: SeShutdownPrivilege 1116 msiexec.exe Token: SeDebugPrivilege 1116 msiexec.exe Token: SeAuditPrivilege 1116 msiexec.exe Token: SeSystemEnvironmentPrivilege 1116 msiexec.exe Token: SeChangeNotifyPrivilege 1116 msiexec.exe Token: SeRemoteShutdownPrivilege 1116 msiexec.exe Token: SeUndockPrivilege 1116 msiexec.exe Token: SeSyncAgentPrivilege 1116 msiexec.exe Token: SeEnableDelegationPrivilege 1116 msiexec.exe Token: SeManageVolumePrivilege 1116 msiexec.exe Token: SeImpersonatePrivilege 1116 msiexec.exe Token: SeCreateGlobalPrivilege 1116 msiexec.exe Token: SeBackupPrivilege 4064 vssvc.exe Token: SeRestorePrivilege 4064 vssvc.exe Token: SeAuditPrivilege 4064 vssvc.exe Token: SeBackupPrivilege 4276 msiexec.exe Token: SeRestorePrivilege 4276 msiexec.exe Token: SeRestorePrivilege 4276 msiexec.exe Token: SeTakeOwnershipPrivilege 4276 msiexec.exe Token: SeRestorePrivilege 4276 msiexec.exe Token: SeTakeOwnershipPrivilege 4276 msiexec.exe Token: SeRestorePrivilege 4276 msiexec.exe Token: SeTakeOwnershipPrivilege 4276 msiexec.exe Token: SeBackupPrivilege 4612 srtasks.exe Token: SeRestorePrivilege 4612 srtasks.exe Token: SeSecurityPrivilege 4612 srtasks.exe Token: SeTakeOwnershipPrivilege 4612 srtasks.exe Token: SeBackupPrivilege 4612 srtasks.exe Token: SeRestorePrivilege 4612 srtasks.exe Token: SeSecurityPrivilege 4612 srtasks.exe Token: SeTakeOwnershipPrivilege 4612 srtasks.exe Token: SeRestorePrivilege 4276 msiexec.exe Token: SeTakeOwnershipPrivilege 4276 msiexec.exe Token: SeRestorePrivilege 4276 msiexec.exe Token: SeTakeOwnershipPrivilege 4276 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1116 msiexec.exe 1116 msiexec.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1728 MSI72DF.tmp - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4276 wrote to memory of 4612 4276 msiexec.exe 94 PID 4276 wrote to memory of 4612 4276 msiexec.exe 94 PID 4276 wrote to memory of 1728 4276 msiexec.exe 96 PID 4276 wrote to memory of 1728 4276 msiexec.exe 96 PID 4276 wrote to memory of 1728 4276 msiexec.exe 96 PID 1728 wrote to memory of 2552 1728 MSI72DF.tmp 100 PID 1728 wrote to memory of 2552 1728 MSI72DF.tmp 100 PID 1728 wrote to memory of 2552 1728 MSI72DF.tmp 100 PID 1728 wrote to memory of 2552 1728 MSI72DF.tmp 100 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\4cea5d8cb3e0a17e942812e31667120a_JaffaCakes118.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1116
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:4612
-
-
C:\Windows\Installer\MSI72DF.tmp"C:\Windows\Installer\MSI72DF.tmp"2⤵
- Checks QEMU agent file
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Executes dropped EXE
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Windows\Installer\MSI72DF.tmp"C:\Windows\Installer\MSI72DF.tmp"3⤵
- Checks QEMU agent file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Loads dropped DLL
PID:2552
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4064
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e577206.rbs
- Size 663B
- SHA256 8e13ab22382cd55fee388847d7436fa01798687786c7fd4d59501a178fc26d18
- MD5 6941d285f50cc352f2ef6d1a92059282
- SHA1 09802f1a59594e1e2fcf67bdcdaa32af7bf936c9
- SHA512 c41639bcfc110886f8fdb4925782fe88ef7746651733939fd96b3841770adfbaef9b5e12e04ea21a65ff7a024ec04830f607e24968d928d824372895154f027b
- MD5 SHA1 SHA512
- Path C:\Windows\Installer\MSI72DF.tmp
- Size 100KB
- SHA256 9fd8a479a9f54341cfea3c2906cbc779c8623a288708ac00e21a486f325e3934
- MD5 9c0f4f8b74d0c49c28997dcc175897c9
- SHA1 56aedf510fe21edf7f5deb00b210e50f54f44443
- SHA512 c2ff13b0737904fc97fdd57a17f9d4885776a5c07d1c3a884292e7143df2966397e4f4820a39450c950b2e3c68fdf2799091357fa9f129ef196e962f4c5e8ba3
- SSDEEP 1536:vul/7WYt61BPnueWzlCd46+Ml3ybnWbHPs:v4/7Rt61BPue4+46+s5HE
- MD5 SHA1 SHA512 SSDEEP
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 23.0MB
- SHA256 eeb6c21017b91422803d5c5252d4cedb2213add200ca43a3b5a84b5bf278af5d
- MD5 483f6226d4fb727afd0670635ae45950
- SHA1 d72844e5e8e8bac6e5b5569f64ccb4f323cfabda
- SHA512 db098b1188652eb6c841398b1f66978e6d3a56c435b673ab333e32517c02107403bef7329b0cc126fbdc0aa325a4c42655bd7ed0494409f1bec5a91d3979a9d2
- SSDEEP 24576:sjdmqn+GdoO/vvTLLsG+/Fr7nxXMGYNzjBAt031gM9qLQJeGYTIq6f7cF:e
- MD5 SHA1 SHA512 SSDEEP
- Path \??\Volume{14f6f45c-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{70287e1a-ce4f-448e-992c-099ef00f1976}_OnDiskSnapshotProp
- Size 6KB
- SHA256 bf0bd408e936ae10d04ff88f4035abd256e20a10cf44f19629911d1a8c3580e7
- MD5 81dd8bd27eb2d1d85cfd3f5167bb0521
- SHA1 f224b216184ba2e5ba3016e2e324acd98f3b2e45
- SHA512 6c406897612279ad293f73af9cd0ce0da100bda513402d5ce1a0635c8e10d7f91f46b8176aa15f46b734e10855ad075932f3fe91d82bc04fbef46719c7a0ba2f
- SSDEEP 96:FWmQ8zYFpDD84LTHzbOHXOHBlBRQJ8Sc9XE56tOSVQpuN:4JVb++sVmN
- MD5 SHA1 SHA512 SSDEEP