c214b43d780cb8822b242bdb293b8bd29b5136c01de8ad49b287738c1d0789a1

Analysis

max time kernel
149s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 03:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a3af5fedfd3690a8ad015b8c280cb945_JaffaCakes118.exe
Size 6.4MB
Sample240613-d3dpyssgkg
SHA256 c214b43d780cb8822b242bdb293b8bd29b5136c01de8ad49b287738c1d0789a1
MD5 a3af5fedfd3690a8ad015b8c280cb945
SHA1 0026f42a3df2b05e2b2f70dc008138383f56f179
SHA512 7b21bd76d93448e7127fdd042db7427de0436de7479c9232d2024a990221c70b4710fa44f14e0ad23020fbe15d54c7cc56cf71c23afc42d38bddc47908cdf4f6
SSDEEP 196608:lPvnRpdpGD4Mbsa8UyVuPkb51DcgblFcKPWdM:BvnXdpkpbS7VF3DRiQWdM
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	a3af5fedfd3690a8ad015b8c280cb945_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 4 IoCs

pid	Process
4208	hi.exe
4812	hi.tmp
4108	rundll.exe
4036	ss.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\rundll = "C:\\Windows\\system32\\wscript.exe C:\\ProgramData\\indus\\start.vbs"	hi.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 4 IoCs

evasion

pid	Process
220	taskkill.exe
1892	taskkill.exe
4680	taskkill.exe
4828	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4812	hi.tmp
4812	hi.tmp

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4680	taskkill.exe
Token: SeDebugPrivilege	4828	taskkill.exe
Token: SeDebugPrivilege	220	taskkill.exe
Token: SeDebugPrivilege	1892	taskkill.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4812	hi.tmp

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 4680	2196	a3af5fedfd3690a8ad015b8c280cb945_JaffaCakes118.exe	81
PID 2196 wrote to memory of 4680	2196	a3af5fedfd3690a8ad015b8c280cb945_JaffaCakes118.exe	81
PID 2196 wrote to memory of 4680	2196	a3af5fedfd3690a8ad015b8c280cb945_JaffaCakes118.exe	81
PID 2196 wrote to memory of 4828	2196	a3af5fedfd3690a8ad015b8c280cb945_JaffaCakes118.exe	85
PID 2196 wrote to memory of 4828	2196	a3af5fedfd3690a8ad015b8c280cb945_JaffaCakes118.exe	85
PID 2196 wrote to memory of 4828	2196	a3af5fedfd3690a8ad015b8c280cb945_JaffaCakes118.exe	85
PID 2196 wrote to memory of 220	2196	a3af5fedfd3690a8ad015b8c280cb945_JaffaCakes118.exe	88
PID 2196 wrote to memory of 220	2196	a3af5fedfd3690a8ad015b8c280cb945_JaffaCakes118.exe	88
PID 2196 wrote to memory of 220	2196	a3af5fedfd3690a8ad015b8c280cb945_JaffaCakes118.exe	88
PID 2196 wrote to memory of 1892	2196	a3af5fedfd3690a8ad015b8c280cb945_JaffaCakes118.exe	91
PID 2196 wrote to memory of 1892	2196	a3af5fedfd3690a8ad015b8c280cb945_JaffaCakes118.exe	91
PID 2196 wrote to memory of 1892	2196	a3af5fedfd3690a8ad015b8c280cb945_JaffaCakes118.exe	91
PID 2196 wrote to memory of 4208	2196	a3af5fedfd3690a8ad015b8c280cb945_JaffaCakes118.exe	94
PID 2196 wrote to memory of 4208	2196	a3af5fedfd3690a8ad015b8c280cb945_JaffaCakes118.exe	94
PID 2196 wrote to memory of 4208	2196	a3af5fedfd3690a8ad015b8c280cb945_JaffaCakes118.exe	94
PID 4208 wrote to memory of 4812	4208	hi.exe	96
PID 4208 wrote to memory of 4812	4208	hi.exe	96
PID 4208 wrote to memory of 4812	4208	hi.exe	96
PID 4812 wrote to memory of 4992	4812	hi.tmp	97
PID 4812 wrote to memory of 4992	4812	hi.tmp	97
PID 4812 wrote to memory of 4992	4812	hi.tmp	97
PID 4992 wrote to memory of 3680	4992	cmd.exe	99
PID 4992 wrote to memory of 3680	4992	cmd.exe	99
PID 4992 wrote to memory of 3680	4992	cmd.exe	99
PID 3680 wrote to memory of 2252	3680	WScript.exe	100
PID 3680 wrote to memory of 2252	3680	WScript.exe	100
PID 3680 wrote to memory of 2252	3680	WScript.exe	100
PID 2252 wrote to memory of 4108	2252	cmd.exe	102
PID 2252 wrote to memory of 4108	2252	cmd.exe	102
PID 2252 wrote to memory of 4108	2252	cmd.exe	102
PID 4108 wrote to memory of 560	4108	rundll.exe	103
PID 4108 wrote to memory of 560	4108	rundll.exe	103
PID 4108 wrote to memory of 560	4108	rundll.exe	103
PID 560 wrote to memory of 4036	560	cmd.exe	104
PID 560 wrote to memory of 4036	560	cmd.exe	104
PID 560 wrote to memory of 4036	560	cmd.exe	104

C:\Users\Admin\AppData\Local\Temp\a3af5fedfd3690a8ad015b8c280cb945_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a3af5fedfd3690a8ad015b8c280cb945_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /IM rundll.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4680
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /IM ss.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4828
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /IM Eternalblue-2.2.0.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:220
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /IM svhost.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1892
- C:\Users\Admin\AppData\Local\Temp\hi.exe
  "C:\Users\Admin\AppData\Local\Temp\hi.exe" /verysilent
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4208
- - C:\Users\Admin\AppData\Local\Temp\is-DP8J3.tmp\hi.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-DP8J3.tmp\hi.tmp" /SL5="$D002A,6240054,57856,C:\Users\Admin\AppData\Local\Temp\hi.exe" /verysilent
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4812
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /C ""autoran.bat""
      4⤵
      Checks computer location settings
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4992
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\indus\start.vbs"
        5⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:3680
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c Rundll.exe
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2252
        
        C:\ProgramData\indus\rundll.exe
        
        Rundll.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4108
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ss.exe TCP 10.127.0.182/14 445 300 /save"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:560
        
        C:\ProgramData\indus\ss.exe
        
        ss.exe TCP 10.127.0.182/14 445 300 /save
        9⤵
        Executes dropped EXE
        
        PID:4036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Result.txt

Path C:\ProgramData\indus\Result.txt
Size 178B
SHA256 50a840c525b87299b86b47f4f56c4d28e937c3ecf05d5e27b46f8fadc31c3724
MD5 6951759826e61a06edc107b086dec1e0
SHA1 9c385d2b75acbec5f9b7adf443b94fb39ec6bea3
SHA512 7bc9e298f25b9fba2fd3c86f01c872c78f93a6727e9d0a1c5287f942333760379c064a573157f025cee2cfaabe64b03067ab4a0610474a75919a234d9fb10b57
MD5 SHA1 SHA512

Submit Download

autoran.bat

Path C:\ProgramData\indus\autoran.bat
Size 23B
SHA256 4e34c1e640ae63d91191be05b16d8df3e5cd918c1290667c9016fb4b77859446
MD5 7d3e123163d0db1b4cd603cb87642c5f
SHA1 d7b9e75ccf3410e1ba169df304d3eb8ce77e451a
SHA512 3d3bf622f732eef5105c1f583b3fb50a8d9258e1e9806e0c7773cc5f0d514454f8f8b4f3ae05f270b9618c58e07735b5bf043728657b02e42b5bb420f9bf956e
MD5 SHA1 SHA512

Submit Download

rundll.exe

Path C:\ProgramData\indus\rundll.exe
Size 5.6MB
SHA256 737376e6933f5ad54c9d8a03c9fdf170f7074769bb55af4b11e31cc7dd1f4b3b
MD5 a6466922af2cfe81ea4b862f84ba1c25
SHA1 5c5d92fe0e2394016ca08410f6198371a3997c0c
SHA512 658c5dec67dff755a57c01f2acbc4f26f46b4caed3416069886defea6bf61df432e10f762ce24938cd24fedcb8d28f11d8c94236f76f1ad00f0e94f30022f09f
SSDEEP 98304:d3Lmqp1B1XgZididUvXMGHbJDPpvSWTjDvu7GYfCVAkV2o8+NM6RfGVhHzlr/AlK:d3qqpWZRKkM4WvDvu7GYmAETtyHB8qLD
MD5 SHA1 SHA512 SSDEEP

Submit Download

ss.exe

Path C:\ProgramData\indus\ss.exe
Size 14KB
SHA256 1328bd220d9b4baa8a92b8d3f42f0d123762972d1dfc4b1fd4b4728d67b01dfc
MD5 c097fd043d3cbabcada0878505c7afa5
SHA1 966a60028a3a24268c049ffadbe1a07b83de24ce
SHA512 0837c537af0c75d5ce06d3ae6e0c6eefe3901535c908843d3771cd468657bca2e3c103b8a84c7c43f2cf1410782a595151fffc3c78fdc0f81277ed4894397fb0
SSDEEP 384:FbvAEV1n+LNA8tmWsejswNlqL9Yql+FgB6BjiMxFV:V3Se+F
MD5 SHA1 SHA512 SSDEEP

Submit Download

start.vbs

Path C:\ProgramData\indus\start.vbs
Size 93B
SHA256 e319000a20de66b8d806dc4811d8dd276d70ea0ed9c65a7f98fad737d7d978f4
MD5 530d5e5137131c7aa3c180de5bf76886
SHA1 472365be2985db297ab3cc761ef5e0ba5bbae1a8
SHA512 42332566142d47db10728214f28c6d49c27e513cbf6f8f126ea30bb6eb179f1cf966e810f57f70173a3cb5e3787a32cf9647a60b67ac0930e0ab67b8e2ddc27d
MD5 SHA1 SHA512

Submit Download

hi.exe

Path C:\Users\Admin\AppData\Local\Temp\hi.exe
Size 6.2MB
SHA256 9b7430d769e404bef49608268a0f91292d472474fa65ef74521626bda1410c7e
MD5 2cb597306ccd2e6fe70e07c266953aa7
SHA1 2856cab01298c7389c0f3c35229ba57ba7bdb12e
SHA512 3d50f7be9f25928cd6433d73f609100c3a7d47b105e7b7f4e92e09a2295f1c2051bbf5b5aa4a44efe735c52b377570e8fe3726643ce34ef13f678377b40755f2
SSDEEP 98304:X58rOGxa3DzraEcc7Nhlo9I8tSlVxHRExi8y/fghh8Bs9oHXx1v29E7BvpRmX3:hua3uRuTo9xEVxHqEfghh8tHXx1fxsH
MD5 SHA1 SHA512 SSDEEP

Submit Download

hi.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-DP8J3.tmp\hi.tmp
Size 697KB
SHA256 cc783a04ccbca4edd06564f8ec88fe5a15f1e3bb26cec7de5e090313520d98f3
MD5 832dab307e54aa08f4b6cdd9b9720361
SHA1 ebd007fb7482040ecf34339e4bf917209c1018df
SHA512 358d43522fd460eb1511708e4df22ea454a95e5bc3c4841931027b5fa3fb1dda05d496d8ad0a8b9279b99e6be74220fe243db8f08ef49845e9fb35c350ef4b49
SSDEEP 12288:usMLIMoi3rPR37dzHRA6nX0D9OKWbO7SERb5rNUK1bce0syxyR:JMcMoi3rPR37dzHRA6G7WbuSEmK50syQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4036-187-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/4108-159-0x000000001E000000-0x000000001E29B000-memory.dmp

Download

memory/4108-166-0x0000000010000000-0x000000001015E000-memory.dmp

Download

memory/4108-163-0x0000000000CB0000-0x0000000000CBE000-memory.dmp

Download

memory/4108-169-0x0000000002C00000-0x0000000002CFE000-memory.dmp

Download

memory/4108-175-0x000000001D110000-0x000000001D116000-memory.dmp

Download

memory/4108-172-0x000000001D170000-0x000000001D184000-memory.dmp

Download

memory/4108-178-0x000000001D1A0000-0x000000001D1B9000-memory.dmp

Download

memory/4108-181-0x0000000003290000-0x000000000333A000-memory.dmp

Download

memory/4208-155-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/4208-11-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/4812-154-0x0000000000400000-0x00000000004BE000-memory.dmp

Download