2e1304dc9b50efc032ba6e9f4e704af0991433e271c633447731bc5255255275

Analysis

max time kernel
148s
max time network
152s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/04/2024, 12:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b8d51e9728f4e520e7af3c096a97fe0c_JaffaCakes118.exe
Size 2.9MB
Sample240404-p47vzagc8v
SHA256 2e1304dc9b50efc032ba6e9f4e704af0991433e271c633447731bc5255255275
MD5 b8d51e9728f4e520e7af3c096a97fe0c
SHA1 a835305645ddeba800045294b4f8f8c1772fe03f
SHA512 3d61ef876b08cd320f880db5e0f36153324c71b34d4be08500b3f42bb17e6268f468661034a3be9d869681d1efd4235f87b0558444ef93248c729d4c10c432d4
SSDEEP 49152:dFjCK+RIzGIabH+LJHYl9QoIL0hWzYg3r+NcurRZ2gAIZCfEKYwkBETj4OGCCMBJ:dFGKCIS7oJHR4g3rPuredIZCfEKYwOEh
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

evasion persistence

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
3	2872	WScript.exe

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Executes dropped EXE 2 IoCs

pid	Process
2520	Image001.exe
1652	lsnm.exe

Loads dropped DLL 8 IoCs

pid	Process
2196	b8d51e9728f4e520e7af3c096a97fe0c_JaffaCakes118.exe
2196	b8d51e9728f4e520e7af3c096a97fe0c_JaffaCakes118.exe
2196	b8d51e9728f4e520e7af3c096a97fe0c_JaffaCakes118.exe
2520	Image001.exe
2520	Image001.exe
2520	Image001.exe
2520	Image001.exe
2520	Image001.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\lsdir\parameters.ini	Image001.exe
File created	C:\Windows\lsdir\lsnm.exe	Image001.exe
File opened for modification	C:\Windows\lsdir\parameters.ini	lsnm.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1960	sc.exe
2788	sc.exe
592	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral1/files/0x000c0000000131a1-7.dat	nsis_installer_1
behavioral1/files/0x000c0000000131a1-7.dat	nsis_installer_2

Runs net.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	3	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
1652	lsnm.exe
1652	lsnm.exe
1652	lsnm.exe
1652	lsnm.exe
1652	lsnm.exe
1652	lsnm.exe
1652	lsnm.exe
1652	lsnm.exe
1652	lsnm.exe
1652	lsnm.exe
1652	lsnm.exe
1652	lsnm.exe
1652	lsnm.exe
1652	lsnm.exe
1652	lsnm.exe
1652	lsnm.exe
1652	lsnm.exe
1652	lsnm.exe
1652	lsnm.exe
1652	lsnm.exe
1652	lsnm.exe
1652	lsnm.exe
1652	lsnm.exe
1652	lsnm.exe
1652	lsnm.exe
1652	lsnm.exe
1652	lsnm.exe
1652	lsnm.exe
1652	lsnm.exe
1652	lsnm.exe
1652	lsnm.exe
1652	lsnm.exe
1652	lsnm.exe
1652	lsnm.exe
1652	lsnm.exe
1652	lsnm.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1652	lsnm.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2552	DllHost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1652	lsnm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 2520	2196	b8d51e9728f4e520e7af3c096a97fe0c_JaffaCakes118.exe	28
PID 2196 wrote to memory of 2520	2196	b8d51e9728f4e520e7af3c096a97fe0c_JaffaCakes118.exe	28
PID 2196 wrote to memory of 2520	2196	b8d51e9728f4e520e7af3c096a97fe0c_JaffaCakes118.exe	28
PID 2196 wrote to memory of 2520	2196	b8d51e9728f4e520e7af3c096a97fe0c_JaffaCakes118.exe	28
PID 2196 wrote to memory of 2520	2196	b8d51e9728f4e520e7af3c096a97fe0c_JaffaCakes118.exe	28
PID 2196 wrote to memory of 2520	2196	b8d51e9728f4e520e7af3c096a97fe0c_JaffaCakes118.exe	28
PID 2196 wrote to memory of 2520	2196	b8d51e9728f4e520e7af3c096a97fe0c_JaffaCakes118.exe	28
PID 2196 wrote to memory of 2872	2196	b8d51e9728f4e520e7af3c096a97fe0c_JaffaCakes118.exe	29
PID 2196 wrote to memory of 2872	2196	b8d51e9728f4e520e7af3c096a97fe0c_JaffaCakes118.exe	29
PID 2196 wrote to memory of 2872	2196	b8d51e9728f4e520e7af3c096a97fe0c_JaffaCakes118.exe	29
PID 2196 wrote to memory of 2872	2196	b8d51e9728f4e520e7af3c096a97fe0c_JaffaCakes118.exe	29
PID 2196 wrote to memory of 2872	2196	b8d51e9728f4e520e7af3c096a97fe0c_JaffaCakes118.exe	29
PID 2196 wrote to memory of 2872	2196	b8d51e9728f4e520e7af3c096a97fe0c_JaffaCakes118.exe	29
PID 2196 wrote to memory of 2872	2196	b8d51e9728f4e520e7af3c096a97fe0c_JaffaCakes118.exe	29
PID 2520 wrote to memory of 2712	2520	Image001.exe	30
PID 2520 wrote to memory of 2712	2520	Image001.exe	30
PID 2520 wrote to memory of 2712	2520	Image001.exe	30
PID 2520 wrote to memory of 2712	2520	Image001.exe	30
PID 2520 wrote to memory of 2712	2520	Image001.exe	30
PID 2520 wrote to memory of 2712	2520	Image001.exe	30
PID 2520 wrote to memory of 2712	2520	Image001.exe	30
PID 2712 wrote to memory of 2580	2712	cmd.exe	33
PID 2712 wrote to memory of 2580	2712	cmd.exe	33
PID 2712 wrote to memory of 2580	2712	cmd.exe	33
PID 2712 wrote to memory of 2580	2712	cmd.exe	33
PID 2712 wrote to memory of 2580	2712	cmd.exe	33
PID 2712 wrote to memory of 2580	2712	cmd.exe	33
PID 2712 wrote to memory of 2580	2712	cmd.exe	33
PID 2580 wrote to memory of 2412	2580	net.exe	34
PID 2580 wrote to memory of 2412	2580	net.exe	34
PID 2580 wrote to memory of 2412	2580	net.exe	34
PID 2580 wrote to memory of 2412	2580	net.exe	34
PID 2580 wrote to memory of 2412	2580	net.exe	34
PID 2580 wrote to memory of 2412	2580	net.exe	34
PID 2580 wrote to memory of 2412	2580	net.exe	34
PID 2520 wrote to memory of 3012	2520	Image001.exe	35
PID 2520 wrote to memory of 3012	2520	Image001.exe	35
PID 2520 wrote to memory of 3012	2520	Image001.exe	35
PID 2520 wrote to memory of 3012	2520	Image001.exe	35
PID 2520 wrote to memory of 3012	2520	Image001.exe	35
PID 2520 wrote to memory of 3012	2520	Image001.exe	35
PID 2520 wrote to memory of 3012	2520	Image001.exe	35
PID 3012 wrote to memory of 1960	3012	cmd.exe	37
PID 3012 wrote to memory of 1960	3012	cmd.exe	37
PID 3012 wrote to memory of 1960	3012	cmd.exe	37
PID 3012 wrote to memory of 1960	3012	cmd.exe	37
PID 3012 wrote to memory of 1960	3012	cmd.exe	37
PID 3012 wrote to memory of 1960	3012	cmd.exe	37
PID 3012 wrote to memory of 1960	3012	cmd.exe	37
PID 2520 wrote to memory of 2752	2520	Image001.exe	38
PID 2520 wrote to memory of 2752	2520	Image001.exe	38
PID 2520 wrote to memory of 2752	2520	Image001.exe	38
PID 2520 wrote to memory of 2752	2520	Image001.exe	38
PID 2520 wrote to memory of 2752	2520	Image001.exe	38
PID 2520 wrote to memory of 2752	2520	Image001.exe	38
PID 2520 wrote to memory of 2752	2520	Image001.exe	38
PID 2752 wrote to memory of 2788	2752	cmd.exe	40
PID 2752 wrote to memory of 2788	2752	cmd.exe	40
PID 2752 wrote to memory of 2788	2752	cmd.exe	40
PID 2752 wrote to memory of 2788	2752	cmd.exe	40
PID 2752 wrote to memory of 2788	2752	cmd.exe	40
PID 2752 wrote to memory of 2788	2752	cmd.exe	40
PID 2752 wrote to memory of 2788	2752	cmd.exe	40
PID 2520 wrote to memory of 2820	2520	Image001.exe	41

C:\Users\Admin\AppData\Local\Temp\b8d51e9728f4e520e7af3c096a97fe0c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b8d51e9728f4e520e7af3c096a97fe0c_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Users\Admin\AppData\Local\Temp\Image001.exe
  "C:\Users\Admin\AppData\Local\Temp\Image001.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2520
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /C net stop WindowsUpdate
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2712
  - - C:\Windows\SysWOW64\net.exe
      net stop WindowsUpdate
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2580
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop WindowsUpdate
        5⤵
        
        PID:2412
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /C Sc delete WindowsUpdate
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3012
  - - C:\Windows\SysWOW64\sc.exe
      Sc delete WindowsUpdate
      4⤵
      Launches sc.exe
      PID:1960
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /C Sc create WindowsUpdate binpath= C:\Windows\lsdir\lsnm.exe start= auto DisplayName= WindowsUpdateServiceCore
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2752
  - - C:\Windows\SysWOW64\sc.exe
      Sc create WindowsUpdate binpath= C:\Windows\lsdir\lsnm.exe start= auto DisplayName= WindowsUpdateServiceCore
      4⤵
      Launches sc.exe
      PID:2788
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /C sc description WindowsUpdate WindowsUpdateServiceCoreMonitor
    3⤵
    PID:2820
  - - C:\Windows\SysWOW64\sc.exe
      sc description WindowsUpdate WindowsUpdateServiceCoreMonitor
      4⤵
      Launches sc.exe
      PID:592
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /C net start WindowsUpdate
    3⤵
    PID:2612
  - - C:\Windows\SysWOW64\net.exe
      net start WindowsUpdate
      4⤵
      PID:1540
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start WindowsUpdate
        5⤵
        
        PID:1040
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\In.vbs"
  2⤵
  - Blocklisted process makes network request
  PID:2872

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Suspicious use of FindShellTrayWindow
PID:2552

C:\Windows\lsdir\lsnm.exe
C:\Windows\lsdir\lsnm.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

(2).jpg

Path C:\Users\Admin\AppData\Local\Temp\(2).jpg
Size 272KB
SHA256 da606fb43fdc6e635a95f8dd2e845c2407135931c59d097ec22580c9c394233a
MD5 1efc28aacc32b3ee741600a1870f37f6
SHA1 e80333a65471f886c269946dcc3fca48b648e5ed
SHA512 bf6651d8568c7153493014ced64ac75dd9835f701b570869103943c4713ddd1da99bcc391909c65aa2a24ba287fb4a83461b97cdc038c2fef464af86fab04a06
SSDEEP 6144:QBPVIXOT/H+9polByAFk0YWKFgW5kNT00Ke6whUHyhEg5G6IUCZ:QBtIXmAkBtk75i0r7SG+G6CZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

In.vbs

Path C:\Users\Admin\AppData\Local\Temp\In.vbs
Size 203B
SHA256 481871068ccb26eed8988b8c0f42861c44826766febb804d7afc7ff43402f37c
MD5 24f8d028a9501052b97aba5f4cddf714
SHA1 8ae1c3a64fda5ab2ab68e0fa53fecee953ceef44
SHA512 a96396fb156faf7dc3112ee7b58ecfa0925ea6aa0b546c7f7c95c631c5c2370aa71660bc12c7848f84e2e1da10725ab0cb99c1d214011649cece4eb67b5b4699
MD5 SHA1 SHA512

Submit Download

lsnm.exe

Path C:\Windows\lsdir\lsnm.exe
Size 6.0MB
SHA256 c538d273a5c4aac147c51b066adc026bd8d3a2e5b7c960cc7b021256a3437665
MD5 5c3b074711292c6b6baff0e00f1df2b9
SHA1 8c61788d713f377639c841bf2f3573d4803e3e8a
SHA512 b554b0fc4ef9c2b13bbba54cec2c1069a03812205463a96d10ac81a19f24a36c349bbfd855aa17bbbdf2d0ca5ec4ae11f91210f845aa2c66b32aa1ef0060a590
SSDEEP 49152:doR4Pmuiszh0499aiCSpuEUA1T+JaU9iMwMREGA93EOjlq/I02TbO6QuXCAqOfmL:doHuXh0ETRU9EMRJFOhcfUQyCAO
MD5 SHA1 SHA512 SSDEEP

Submit Download

parameters.ini

Path C:\Windows\lsdir\parameters.ini
Size 224B
SHA256 7620efef43a1a58ffe99ffe595286596c378d6068a4ab4b756cdfc7875da8f66
MD5 45f90eb8c88df668e6171a8509e97035
SHA1 d4a01a2c7823b5d1b2635966f161f0c2bf896270
SHA512 cb93163f3495e05203af27f242d2d08f6547a29bad450164d7b98fa3a6d8d87052ef929dc604d85a597151b6abb38d0d59185709fba777886ff58c8da0b09f87
MD5 SHA1 SHA512

Submit Download

parameters.ini

Path C:\Windows\lsdir\parameters.ini
Size 269B
SHA256 5affa065af5a30d34ffde038f8ea8ec9630e7b0a00f2d24de531bd3d92769514
MD5 827d65b99cb5d861c792e676208b0f5a
SHA1 49b409ffa1c502417ee1b6c4b5a4a7f39bf7859f
SHA512 6e4df5f26c4343045baa45068b2be975d38c9c53e9873d33ffb3b4a99345614fa982489bbe846a2c7a8c0e2b79a75bac8c39e87424ddc3fb76bc81b1ca0bbf76
MD5 SHA1 SHA512

Submit Download

Image001.exe

Path \Users\Admin\AppData\Local\Temp\Image001.exe
Size 2.3MB
SHA256 d0a93fcf97dcad1c812e77619cec563afc6d846d1594b891530d2cf415df933b
MD5 20945c7b1ef7fc765aa4a338ab78ae87
SHA1 eeb17eefa83ec1106c2b8cb1935a84f19eb6d1ca
SHA512 bd222195af7ac8052166b0350b5ac0a09df19487897d561f4ed97298eecd639adc5c47d0e68c283b16d737e52a158499e436c30a0185aef56931c7483ffd103b
SSDEEP 49152:B8kiMEUfGnvRb+kyNK2MRdssKPr8Th1nr8CxceFb7QKA:B8knEiGvRzrzdsbAjLRFbkKA
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsExec.dll

Path \Users\Admin\AppData\Local\Temp\nso4867.tmp\nsExec.dll
Size 6KB
SHA256 288100583f65a2b7acfc0c7e231c0e268c58d3067675543f627c01e82f6fd884
MD5 b5a1f9dc73e2944a388a61411bdd8c70
SHA1 dc9b20df3f3810c2e81a0c54dea385704ba8bef7
SHA512 b9c8d71b5da00f2aff7847b9ec3bd8a588afeb525f47a0df235b52f7b2233edb3928a2c8e0b493f287c923cc52a340ad6fee99822595d6591df0e97870de92a8
SSDEEP 96:p7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNQ3e:lXhHR0aTQN4gRHdMqJVgNH
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1652-65-0x00000000002F0000-0x00000000002F1000-memory.dmp

Download

memory/1652-73-0x0000000000400000-0x0000000000A2C000-memory.dmp

Download

memory/1652-77-0x0000000000400000-0x0000000000A2C000-memory.dmp

Download

memory/1652-63-0x0000000000400000-0x0000000000A2C000-memory.dmp

Download

memory/1652-64-0x0000000000400000-0x0000000000A2C000-memory.dmp

Download

memory/1652-76-0x0000000000400000-0x0000000000A2C000-memory.dmp

Download

memory/1652-66-0x0000000000400000-0x0000000000A2C000-memory.dmp

Download

memory/1652-67-0x0000000000400000-0x0000000000A2C000-memory.dmp

Download

memory/1652-68-0x0000000000400000-0x0000000000A2C000-memory.dmp

Download

memory/1652-69-0x0000000000400000-0x0000000000A2C000-memory.dmp

Download

memory/1652-70-0x0000000000400000-0x0000000000A2C000-memory.dmp

Download

memory/1652-71-0x0000000000400000-0x0000000000A2C000-memory.dmp

Download

memory/1652-72-0x0000000000400000-0x0000000000A2C000-memory.dmp

Download

memory/1652-48-0x00000000002F0000-0x00000000002F1000-memory.dmp

Download

memory/1652-74-0x0000000000400000-0x0000000000A2C000-memory.dmp

Download

memory/1652-75-0x0000000000400000-0x0000000000A2C000-memory.dmp

Download

memory/2196-26-0x00000000035D0000-0x00000000035D2000-memory.dmp

Download

memory/2552-27-0x0000000000170000-0x0000000000172000-memory.dmp

Download