2e1304dc9b50efc032ba6e9f4e704af0991433e271c633447731bc5255255275

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2024, 12:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b8d51e9728f4e520e7af3c096a97fe0c_JaffaCakes118.exe
Size 2.9MB
Sample240404-p47vzagc8v
SHA256 2e1304dc9b50efc032ba6e9f4e704af0991433e271c633447731bc5255255275
MD5 b8d51e9728f4e520e7af3c096a97fe0c
SHA1 a835305645ddeba800045294b4f8f8c1772fe03f
SHA512 3d61ef876b08cd320f880db5e0f36153324c71b34d4be08500b3f42bb17e6268f468661034a3be9d869681d1efd4235f87b0558444ef93248c729d4c10c432d4
SSDEEP 49152:dFjCK+RIzGIabH+LJHYl9QoIL0hWzYg3r+NcurRZ2gAIZCfEKYwkBETj4OGCCMBJ:dFGKCIS7oJHR4g3rPuredIZCfEKYwOEh
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

evasion persistence

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
8	4860	WScript.exe

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation	b8d51e9728f4e520e7af3c096a97fe0c_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

pid	Process
4452	Image001.exe
2868	lsnm.exe

Loads dropped DLL 5 IoCs

pid	Process
4452	Image001.exe
4452	Image001.exe
4452	Image001.exe
4452	Image001.exe
4452	Image001.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\lsdir\parameters.ini	Image001.exe
File created	C:\Windows\lsdir\lsnm.exe	Image001.exe
File opened for modification	C:\Windows\lsdir\parameters.ini	lsnm.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1912	sc.exe
4620	sc.exe
4816	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral2/files/0x0007000000023230-8.dat	nsis_installer_1
behavioral2/files/0x0007000000023230-8.dat	nsis_installer_2

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings	b8d51e9728f4e520e7af3c096a97fe0c_JaffaCakes118.exe

Runs net.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	8	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2868	lsnm.exe
2868	lsnm.exe
2868	lsnm.exe
2868	lsnm.exe
2868	lsnm.exe
2868	lsnm.exe
2868	lsnm.exe
2868	lsnm.exe
2868	lsnm.exe
2868	lsnm.exe
2868	lsnm.exe
2868	lsnm.exe
2868	lsnm.exe
2868	lsnm.exe
2868	lsnm.exe
2868	lsnm.exe
2868	lsnm.exe
2868	lsnm.exe
2868	lsnm.exe
2868	lsnm.exe
2868	lsnm.exe
2868	lsnm.exe
2868	lsnm.exe
2868	lsnm.exe
2868	lsnm.exe
2868	lsnm.exe
2868	lsnm.exe
2868	lsnm.exe
2868	lsnm.exe
2868	lsnm.exe
2868	lsnm.exe
2868	lsnm.exe
2868	lsnm.exe
2868	lsnm.exe
2868	lsnm.exe
2868	lsnm.exe
2868	lsnm.exe
2868	lsnm.exe
2868	lsnm.exe
2868	lsnm.exe
2868	lsnm.exe
2868	lsnm.exe
2868	lsnm.exe
2868	lsnm.exe
2868	lsnm.exe
2868	lsnm.exe
2868	lsnm.exe
2868	lsnm.exe
2868	lsnm.exe
2868	lsnm.exe
2868	lsnm.exe
2868	lsnm.exe
2868	lsnm.exe
2868	lsnm.exe
2868	lsnm.exe
2868	lsnm.exe
2868	lsnm.exe
2868	lsnm.exe
2868	lsnm.exe
2868	lsnm.exe
2868	lsnm.exe
2868	lsnm.exe
2868	lsnm.exe
2868	lsnm.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2868	lsnm.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4452	Image001.exe
2148	cmd.exe
2000	cmd.exe
4788	cmd.exe
1660	cmd.exe
1424	cmd.exe
2868	lsnm.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4968 wrote to memory of 4452	4968	b8d51e9728f4e520e7af3c096a97fe0c_JaffaCakes118.exe	89
PID 4968 wrote to memory of 4452	4968	b8d51e9728f4e520e7af3c096a97fe0c_JaffaCakes118.exe	89
PID 4968 wrote to memory of 4452	4968	b8d51e9728f4e520e7af3c096a97fe0c_JaffaCakes118.exe	89
PID 4968 wrote to memory of 4860	4968	b8d51e9728f4e520e7af3c096a97fe0c_JaffaCakes118.exe	91
PID 4968 wrote to memory of 4860	4968	b8d51e9728f4e520e7af3c096a97fe0c_JaffaCakes118.exe	91
PID 4968 wrote to memory of 4860	4968	b8d51e9728f4e520e7af3c096a97fe0c_JaffaCakes118.exe	91
PID 4452 wrote to memory of 2148	4452	Image001.exe	92
PID 4452 wrote to memory of 2148	4452	Image001.exe	92
PID 4452 wrote to memory of 2148	4452	Image001.exe	92
PID 2148 wrote to memory of 3296	2148	cmd.exe	94
PID 2148 wrote to memory of 3296	2148	cmd.exe	94
PID 2148 wrote to memory of 3296	2148	cmd.exe	94
PID 3296 wrote to memory of 3596	3296	net.exe	95
PID 3296 wrote to memory of 3596	3296	net.exe	95
PID 3296 wrote to memory of 3596	3296	net.exe	95
PID 4452 wrote to memory of 2000	4452	Image001.exe	96
PID 4452 wrote to memory of 2000	4452	Image001.exe	96
PID 4452 wrote to memory of 2000	4452	Image001.exe	96
PID 2000 wrote to memory of 1912	2000	cmd.exe	98
PID 2000 wrote to memory of 1912	2000	cmd.exe	98
PID 2000 wrote to memory of 1912	2000	cmd.exe	98
PID 4452 wrote to memory of 4788	4452	Image001.exe	99
PID 4452 wrote to memory of 4788	4452	Image001.exe	99
PID 4452 wrote to memory of 4788	4452	Image001.exe	99
PID 4788 wrote to memory of 4620	4788	cmd.exe	101
PID 4788 wrote to memory of 4620	4788	cmd.exe	101
PID 4788 wrote to memory of 4620	4788	cmd.exe	101
PID 4452 wrote to memory of 1660	4452	Image001.exe	102
PID 4452 wrote to memory of 1660	4452	Image001.exe	102
PID 4452 wrote to memory of 1660	4452	Image001.exe	102
PID 1660 wrote to memory of 4816	1660	cmd.exe	104
PID 1660 wrote to memory of 4816	1660	cmd.exe	104
PID 1660 wrote to memory of 4816	1660	cmd.exe	104
PID 4452 wrote to memory of 1424	4452	Image001.exe	105
PID 4452 wrote to memory of 1424	4452	Image001.exe	105
PID 4452 wrote to memory of 1424	4452	Image001.exe	105
PID 1424 wrote to memory of 2052	1424	cmd.exe	107
PID 1424 wrote to memory of 2052	1424	cmd.exe	107
PID 1424 wrote to memory of 2052	1424	cmd.exe	107
PID 2052 wrote to memory of 4484	2052	net.exe	108
PID 2052 wrote to memory of 4484	2052	net.exe	108
PID 2052 wrote to memory of 4484	2052	net.exe	108

C:\Users\Admin\AppData\Local\Temp\b8d51e9728f4e520e7af3c096a97fe0c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b8d51e9728f4e520e7af3c096a97fe0c_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Users\Admin\AppData\Local\Temp\Image001.exe
  "C:\Users\Admin\AppData\Local\Temp\Image001.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4452
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /C net stop WindowsUpdate
    3⤵
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2148
  - - C:\Windows\SysWOW64\net.exe
      net stop WindowsUpdate
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3296
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop WindowsUpdate
        5⤵
        
        PID:3596
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /C Sc delete WindowsUpdate
    3⤵
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2000
  - - C:\Windows\SysWOW64\sc.exe
      Sc delete WindowsUpdate
      4⤵
      Launches sc.exe
      PID:1912
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /C Sc create WindowsUpdate binpath= C:\Windows\lsdir\lsnm.exe start= auto DisplayName= WindowsUpdateServiceCore
    3⤵
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4788
  - - C:\Windows\SysWOW64\sc.exe
      Sc create WindowsUpdate binpath= C:\Windows\lsdir\lsnm.exe start= auto DisplayName= WindowsUpdateServiceCore
      4⤵
      Launches sc.exe
      PID:4620
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /C sc description WindowsUpdate WindowsUpdateServiceCoreMonitor
    3⤵
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1660
  - - C:\Windows\SysWOW64\sc.exe
      sc description WindowsUpdate WindowsUpdateServiceCoreMonitor
      4⤵
      Launches sc.exe
      PID:4816
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /C net start WindowsUpdate
    3⤵
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1424
  - - C:\Windows\SysWOW64\net.exe
      net start WindowsUpdate
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2052
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start WindowsUpdate
        5⤵
        
        PID:4484
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\In.vbs"
  2⤵
  - Blocklisted process makes network request
  PID:4860

C:\Windows\lsdir\lsnm.exe
C:\Windows\lsdir\lsnm.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

Image001.exe

Path C:\Users\Admin\AppData\Local\Temp\Image001.exe
Size 2.3MB
SHA256 d0a93fcf97dcad1c812e77619cec563afc6d846d1594b891530d2cf415df933b
MD5 20945c7b1ef7fc765aa4a338ab78ae87
SHA1 eeb17eefa83ec1106c2b8cb1935a84f19eb6d1ca
SHA512 bd222195af7ac8052166b0350b5ac0a09df19487897d561f4ed97298eecd639adc5c47d0e68c283b16d737e52a158499e436c30a0185aef56931c7483ffd103b
SSDEEP 49152:B8kiMEUfGnvRb+kyNK2MRdssKPr8Th1nr8CxceFb7QKA:B8knEiGvRzrzdsbAjLRFbkKA
MD5 SHA1 SHA512 SSDEEP

Submit Download

In.vbs

Path C:\Users\Admin\AppData\Local\Temp\In.vbs
Size 203B
SHA256 481871068ccb26eed8988b8c0f42861c44826766febb804d7afc7ff43402f37c
MD5 24f8d028a9501052b97aba5f4cddf714
SHA1 8ae1c3a64fda5ab2ab68e0fa53fecee953ceef44
SHA512 a96396fb156faf7dc3112ee7b58ecfa0925ea6aa0b546c7f7c95c631c5c2370aa71660bc12c7848f84e2e1da10725ab0cb99c1d214011649cece4eb67b5b4699
MD5 SHA1 SHA512

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsu9D99.tmp\nsExec.dll
Size 6KB
SHA256 288100583f65a2b7acfc0c7e231c0e268c58d3067675543f627c01e82f6fd884
MD5 b5a1f9dc73e2944a388a61411bdd8c70
SHA1 dc9b20df3f3810c2e81a0c54dea385704ba8bef7
SHA512 b9c8d71b5da00f2aff7847b9ec3bd8a588afeb525f47a0df235b52f7b2233edb3928a2c8e0b493f287c923cc52a340ad6fee99822595d6591df0e97870de92a8
SSDEEP 96:p7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNQ3e:lXhHR0aTQN4gRHdMqJVgNH
MD5 SHA1 SHA512 SSDEEP

Submit Download

lsnm.exe

Path C:\Windows\lsdir\lsnm.exe
Size 6.0MB
SHA256 c538d273a5c4aac147c51b066adc026bd8d3a2e5b7c960cc7b021256a3437665
MD5 5c3b074711292c6b6baff0e00f1df2b9
SHA1 8c61788d713f377639c841bf2f3573d4803e3e8a
SHA512 b554b0fc4ef9c2b13bbba54cec2c1069a03812205463a96d10ac81a19f24a36c349bbfd855aa17bbbdf2d0ca5ec4ae11f91210f845aa2c66b32aa1ef0060a590
SSDEEP 49152:doR4Pmuiszh0499aiCSpuEUA1T+JaU9iMwMREGA93EOjlq/I02TbO6QuXCAqOfmL:doHuXh0ETRU9EMRJFOhcfUQyCAO
MD5 SHA1 SHA512 SSDEEP

Submit Download

parameters.ini

Path C:\Windows\lsdir\parameters.ini
Size 224B
SHA256 7620efef43a1a58ffe99ffe595286596c378d6068a4ab4b756cdfc7875da8f66
MD5 45f90eb8c88df668e6171a8509e97035
SHA1 d4a01a2c7823b5d1b2635966f161f0c2bf896270
SHA512 cb93163f3495e05203af27f242d2d08f6547a29bad450164d7b98fa3a6d8d87052ef929dc604d85a597151b6abb38d0d59185709fba777886ff58c8da0b09f87
MD5 SHA1 SHA512

Submit Download

parameters.ini

Path C:\Windows\lsdir\parameters.ini
Size 269B
SHA256 70d4f4d8583ef87b4ec3572f2d951abe594ac880beaf55857e8399ef223fa980
MD5 217953146fbb0db461a5d1c62cd87259
SHA1 af78e2bd51acb9a63ce8b792a23813ad9fa46bbe
SHA512 af7183384dac2543fcb401c78d8754978e1ffaf46c80872617faafc815206406fa8ce21ab03900bc22f63ab0818067f24cd6613841ea1988f7fe77f34c7d3b60
MD5 SHA1 SHA512

Submit Download

memory/2868-58-0x0000000000400000-0x0000000000A2C000-memory.dmp

Download

memory/2868-61-0x0000000000400000-0x0000000000A2C000-memory.dmp

Download

memory/2868-56-0x0000000000400000-0x0000000000A2C000-memory.dmp

Download

memory/2868-57-0x0000000000C10000-0x0000000000C11000-memory.dmp

Download

memory/2868-40-0x0000000000C10000-0x0000000000C11000-memory.dmp

Download

memory/2868-59-0x0000000000400000-0x0000000000A2C000-memory.dmp

Download

memory/2868-60-0x0000000000400000-0x0000000000A2C000-memory.dmp

Download

memory/2868-55-0x0000000000400000-0x0000000000A2C000-memory.dmp

Download

memory/2868-62-0x0000000000400000-0x0000000000A2C000-memory.dmp

Download

memory/2868-63-0x0000000000400000-0x0000000000A2C000-memory.dmp

Download

memory/2868-64-0x0000000000400000-0x0000000000A2C000-memory.dmp

Download

memory/2868-65-0x0000000000400000-0x0000000000A2C000-memory.dmp

Download

memory/2868-66-0x0000000000400000-0x0000000000A2C000-memory.dmp

Download

memory/2868-67-0x0000000000400000-0x0000000000A2C000-memory.dmp

Download

memory/2868-68-0x0000000000400000-0x0000000000A2C000-memory.dmp

Download

memory/2868-69-0x0000000000400000-0x0000000000A2C000-memory.dmp

Download