b5b9bf1ace516c14223057475b9c9a61fc20b44adaa40e48863ab1efe45f81c2

Analysis

max time kernel
150s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
02/05/2024, 12:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0e8aaf57808c3c1e23e04361c078a5c9_JaffaCakes118.exe
Size 467KB
Sample240502-pz4mrabc72
SHA256 b5b9bf1ace516c14223057475b9c9a61fc20b44adaa40e48863ab1efe45f81c2
MD5 0e8aaf57808c3c1e23e04361c078a5c9
SHA1 5445c802d6b3b8d745fd425c3725eab239d63239
SHA512 20af3e416e8c7e0e9976d489af286c19b2eddb21597539b7fdddbfba4b7624c1ae9f88749a5dbe13d1a091b62dc5b07307d2ef1726579cac4f43e08833cb4069
SSDEEP 12288:1Ov5jKhsfoPA+yeVKUCUxP4C902bdRtJJPiCyrJ2LAc1YS3r:1q5TfcdHj4fmbWJqt1h
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion persistence trojan upx

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	0e8aaf57808c3c1e23e04361c078a5c9_JaffaCakes118.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3948	netsh.exe

Executes dropped EXE 1 IoCs

pid	Process
2220	securityscan.exe

UPX packed file 19 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3696-0-0x0000000000F70000-0x000000000108B000-memory.dmp	upx
behavioral2/files/0x000a000000023bc1-14.dat	upx
behavioral2/memory/3696-16-0x0000000000F70000-0x000000000108B000-memory.dmp	upx
behavioral2/memory/2220-17-0x0000000000FB0000-0x00000000010CB000-memory.dmp	upx
behavioral2/memory/2220-25-0x0000000000FB0000-0x00000000010CB000-memory.dmp	upx
behavioral2/memory/2220-26-0x0000000000FB0000-0x00000000010CB000-memory.dmp	upx
behavioral2/memory/2220-27-0x0000000000FB0000-0x00000000010CB000-memory.dmp	upx
behavioral2/memory/2220-28-0x0000000000FB0000-0x00000000010CB000-memory.dmp	upx
behavioral2/memory/2220-32-0x0000000000FB0000-0x00000000010CB000-memory.dmp	upx
behavioral2/memory/2220-33-0x0000000000FB0000-0x00000000010CB000-memory.dmp	upx
behavioral2/memory/2220-34-0x0000000000FB0000-0x00000000010CB000-memory.dmp	upx
behavioral2/memory/2220-35-0x0000000000FB0000-0x00000000010CB000-memory.dmp	upx
behavioral2/memory/2220-36-0x0000000000FB0000-0x00000000010CB000-memory.dmp	upx
behavioral2/memory/2220-37-0x0000000000FB0000-0x00000000010CB000-memory.dmp	upx
behavioral2/memory/2220-38-0x0000000000FB0000-0x00000000010CB000-memory.dmp	upx
behavioral2/memory/2220-39-0x0000000000FB0000-0x00000000010CB000-memory.dmp	upx
behavioral2/memory/2220-40-0x0000000000FB0000-0x00000000010CB000-memory.dmp	upx
behavioral2/memory/2220-41-0x0000000000FB0000-0x00000000010CB000-memory.dmp	upx
behavioral2/memory/2220-42-0x0000000000FB0000-0x00000000010CB000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\securityscan = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\log\\AutoUpdate.exe"	0e8aaf57808c3c1e23e04361c078a5c9_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\securityscan = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\log\\securityscan.exe"	securityscan.exe

AutoIT Executable 16 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/3696-16-0x0000000000F70000-0x000000000108B000-memory.dmp	autoit_exe
behavioral2/memory/2220-25-0x0000000000FB0000-0x00000000010CB000-memory.dmp	autoit_exe
behavioral2/memory/2220-26-0x0000000000FB0000-0x00000000010CB000-memory.dmp	autoit_exe
behavioral2/memory/2220-27-0x0000000000FB0000-0x00000000010CB000-memory.dmp	autoit_exe
behavioral2/memory/2220-28-0x0000000000FB0000-0x00000000010CB000-memory.dmp	autoit_exe
behavioral2/memory/2220-32-0x0000000000FB0000-0x00000000010CB000-memory.dmp	autoit_exe
behavioral2/memory/2220-33-0x0000000000FB0000-0x00000000010CB000-memory.dmp	autoit_exe
behavioral2/memory/2220-34-0x0000000000FB0000-0x00000000010CB000-memory.dmp	autoit_exe
behavioral2/memory/2220-35-0x0000000000FB0000-0x00000000010CB000-memory.dmp	autoit_exe
behavioral2/memory/2220-36-0x0000000000FB0000-0x00000000010CB000-memory.dmp	autoit_exe
behavioral2/memory/2220-37-0x0000000000FB0000-0x00000000010CB000-memory.dmp	autoit_exe
behavioral2/memory/2220-38-0x0000000000FB0000-0x00000000010CB000-memory.dmp	autoit_exe
behavioral2/memory/2220-39-0x0000000000FB0000-0x00000000010CB000-memory.dmp	autoit_exe
behavioral2/memory/2220-40-0x0000000000FB0000-0x00000000010CB000-memory.dmp	autoit_exe
behavioral2/memory/2220-41-0x0000000000FB0000-0x00000000010CB000-memory.dmp	autoit_exe
behavioral2/memory/2220-42-0x0000000000FB0000-0x00000000010CB000-memory.dmp	autoit_exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
1504	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1504	taskkill.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2220	securityscan.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3696 wrote to memory of 4168	3696	0e8aaf57808c3c1e23e04361c078a5c9_JaffaCakes118.exe	83
PID 3696 wrote to memory of 4168	3696	0e8aaf57808c3c1e23e04361c078a5c9_JaffaCakes118.exe	83
PID 3696 wrote to memory of 4168	3696	0e8aaf57808c3c1e23e04361c078a5c9_JaffaCakes118.exe	83
PID 4168 wrote to memory of 3748	4168	cmd.exe	85
PID 4168 wrote to memory of 3748	4168	cmd.exe	85
PID 4168 wrote to memory of 3748	4168	cmd.exe	85
PID 3696 wrote to memory of 2188	3696	0e8aaf57808c3c1e23e04361c078a5c9_JaffaCakes118.exe	86
PID 3696 wrote to memory of 2188	3696	0e8aaf57808c3c1e23e04361c078a5c9_JaffaCakes118.exe	86
PID 3696 wrote to memory of 2188	3696	0e8aaf57808c3c1e23e04361c078a5c9_JaffaCakes118.exe	86
PID 2188 wrote to memory of 3948	2188	cmd.exe	88
PID 2188 wrote to memory of 3948	2188	cmd.exe	88
PID 2188 wrote to memory of 3948	2188	cmd.exe	88
PID 3696 wrote to memory of 3492	3696	0e8aaf57808c3c1e23e04361c078a5c9_JaffaCakes118.exe	92
PID 3696 wrote to memory of 3492	3696	0e8aaf57808c3c1e23e04361c078a5c9_JaffaCakes118.exe	92
PID 3696 wrote to memory of 3492	3696	0e8aaf57808c3c1e23e04361c078a5c9_JaffaCakes118.exe	92
PID 3696 wrote to memory of 4308	3696	0e8aaf57808c3c1e23e04361c078a5c9_JaffaCakes118.exe	93
PID 3696 wrote to memory of 4308	3696	0e8aaf57808c3c1e23e04361c078a5c9_JaffaCakes118.exe	93
PID 3696 wrote to memory of 4308	3696	0e8aaf57808c3c1e23e04361c078a5c9_JaffaCakes118.exe	93
PID 3492 wrote to memory of 1504	3492	cmd.exe	96
PID 3492 wrote to memory of 1504	3492	cmd.exe	96
PID 3492 wrote to memory of 1504	3492	cmd.exe	96
PID 3696 wrote to memory of 2220	3696	0e8aaf57808c3c1e23e04361c078a5c9_JaffaCakes118.exe	97
PID 3696 wrote to memory of 2220	3696	0e8aaf57808c3c1e23e04361c078a5c9_JaffaCakes118.exe	97
PID 3696 wrote to memory of 2220	3696	0e8aaf57808c3c1e23e04361c078a5c9_JaffaCakes118.exe	97
PID 2220 wrote to memory of 4488	2220	securityscan.exe	98
PID 2220 wrote to memory of 4488	2220	securityscan.exe	98
PID 2220 wrote to memory of 4488	2220	securityscan.exe	98
PID 4488 wrote to memory of 3700	4488	cmd.exe	101
PID 4488 wrote to memory of 3700	4488	cmd.exe	101
PID 4488 wrote to memory of 3700	4488	cmd.exe	101

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	0e8aaf57808c3c1e23e04361c078a5c9_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\TaskbarNoNotification = "1"	0e8aaf57808c3c1e23e04361c078a5c9_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	0e8aaf57808c3c1e23e04361c078a5c9_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	0e8aaf57808c3c1e23e04361c078a5c9_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\0e8aaf57808c3c1e23e04361c078a5c9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0e8aaf57808c3c1e23e04361c078a5c9_JaffaCakes118.exe"
1⤵
- UAC bypass
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3696
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /k HOSTNAME
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4168
- - C:\Windows\SysWOW64\HOSTNAME.EXE
    HOSTNAME
    3⤵
    PID:3748
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh firewall add allowedprogram program = STcONaURjstoJeQ(uMqeEfSfaGeNmho("yJmAEIBBXdvRXSFRGegUiJnA")) name = STcONaURjstoJeQ(uMqeEfSfaGeNmho("XQ0V1bwVGZ0FQZ==")) mode = ENABLE
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2188
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram program = STcONaURjstoJeQ(uMqeEfSfaGeNmho("yJmAEIBBXdvRXSFRGegUiJnA")) name = STcONaURjstoJeQ(uMqeEfSfaGeNmho("XQ0V1bwVGZ0FQZ==")) mode = ENABLE
    3⤵
    - Modifies Windows Firewall
    PID:3948
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im chrome.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3492
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1504
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\Microsoft\log\pass.exe all
  2⤵
  PID:4308
- C:\Users\Admin\AppData\Roaming\Microsoft\log\securityscan.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\log\securityscan.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2220
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /k HOSTNAME
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4488
  - - C:\Windows\SysWOW64\HOSTNAME.EXE
      HOSTNAME
      4⤵
      PID:3700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

celpucu

Path C:\Users\Admin\AppData\Local\Temp\celpucu
Size 34KB
SHA256 1fd9d894dabd437b7449966b723d77cf45ae66c19194be02afb8d8170d6f159b
MD5 76d389d22089c1e952349f722d4362fb
SHA1 997929dff36b7f61acb289033ccfc86ea00be63a
SHA512 5d291787683f435c9e5cf0a28826fbfcfb2b0ae3ca2e10bb01954988255988323ccd92628e7293ca154e4794af7382b24effcab210f6ddd932860d7f30b9b855
SSDEEP 384:/3jfI39PsttZZBBUq6OwsNPbfLUybGfqI84GOIks3wsH9C47VMnranon7JqCk+ry:7Os6uNgvvXh7wT
MD5 SHA1 SHA512 SSDEEP

Submit Download

securityscan.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\log\securityscan.exe
Size 467KB
SHA256 b5b9bf1ace516c14223057475b9c9a61fc20b44adaa40e48863ab1efe45f81c2
MD5 0e8aaf57808c3c1e23e04361c078a5c9
SHA1 5445c802d6b3b8d745fd425c3725eab239d63239
SHA512 20af3e416e8c7e0e9976d489af286c19b2eddb21597539b7fdddbfba4b7624c1ae9f88749a5dbe13d1a091b62dc5b07307d2ef1726579cac4f43e08833cb4069
SSDEEP 12288:1Ov5jKhsfoPA+yeVKUCUxP4C902bdRtJJPiCyrJ2LAc1YS3r:1q5TfcdHj4fmbWJqt1h
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2220-32-0x0000000000FB0000-0x00000000010CB000-memory.dmp

Download

memory/2220-34-0x0000000000FB0000-0x00000000010CB000-memory.dmp

Download

memory/2220-25-0x0000000000FB0000-0x00000000010CB000-memory.dmp

Download

memory/2220-26-0x0000000000FB0000-0x00000000010CB000-memory.dmp

Download

memory/2220-27-0x0000000000FB0000-0x00000000010CB000-memory.dmp

Download

memory/2220-28-0x0000000000FB0000-0x00000000010CB000-memory.dmp

Download

memory/2220-42-0x0000000000FB0000-0x00000000010CB000-memory.dmp

Download

memory/2220-41-0x0000000000FB0000-0x00000000010CB000-memory.dmp

Download

memory/2220-33-0x0000000000FB0000-0x00000000010CB000-memory.dmp

Download

memory/2220-17-0x0000000000FB0000-0x00000000010CB000-memory.dmp

Download

memory/2220-35-0x0000000000FB0000-0x00000000010CB000-memory.dmp

Download

memory/2220-36-0x0000000000FB0000-0x00000000010CB000-memory.dmp

Download

memory/2220-37-0x0000000000FB0000-0x00000000010CB000-memory.dmp

Download

memory/2220-38-0x0000000000FB0000-0x00000000010CB000-memory.dmp

Download

memory/2220-39-0x0000000000FB0000-0x00000000010CB000-memory.dmp

Download

memory/2220-40-0x0000000000FB0000-0x00000000010CB000-memory.dmp

Download

memory/3696-0-0x0000000000F70000-0x000000000108B000-memory.dmp

Download

memory/3696-16-0x0000000000F70000-0x000000000108B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads