Malware Analysis Report

2024-10-16 02:27

Sample ID 240702-22vh3svbkg
Target 1dcad7c8f56207b2c423353f0c328755_JaffaCakes118
SHA256 4e6531aa7f8fdb4c21f0559b2b7951afbc2624e9a69a0588c1633508a173ab38
Tags
isfb gozi persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

4e6531aa7f8fdb4c21f0559b2b7951afbc2624e9a69a0588c1633508a173ab38

Threat Level: Known bad

The file 1dcad7c8f56207b2c423353f0c328755_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

isfb gozi persistence

Gozi family

Server Software Component: Terminal Services DLL

Loads dropped DLL

Executes dropped EXE

Checks computer location settings

Drops file in System32 directory

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Modifies data under HKEY_USERS

Runs net.exe

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-07-02 23:05

Signatures

Gozi family

gozi

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-02 23:05

Reported

2024-07-02 23:07

Platform

win7-20240508-en

Max time kernel

121s

Max time network

122s

Command Line

C:\Windows\Explorer.EXE

Signatures

Server Software Component: Terminal Services DLL

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "C:\\Windows\\system32\\FastUserSwitchingCompatibilityex.dll" C:\Users\Admin\AppData\Local\Temp\net.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\temp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\net.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357 C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Windows\system32\sysprep\Panther\diagerr.xml C:\Windows\system32\sysprep\sysprep.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357 C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Windows\system32\sysprep\Panther\setupact.log C:\Windows\system32\sysprep\sysprep.exe N/A
File created C:\Windows\SysWOW64\FastUserSwitchingCompatibilityex.dll C:\Users\Admin\AppData\Local\Temp\net.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Windows\system32\sysprep\Panther\setuperr.log C:\Windows\system32\sysprep\sysprep.exe N/A
File opened for modification C:\Windows\system32\sysprep\Panther\diagwrn.xml C:\Windows\system32\sysprep\sysprep.exe N/A
File opened for modification C:\Windows\SysWOW64\svchost.log C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat C:\Windows\SysWOW64\svchost.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\system\config_t.dat C:\Users\Admin\AppData\Local\Temp\net.exe N/A
File opened for modification C:\Windows\system\config_t.dat C:\Users\Admin\AppData\Local\Temp\net.exe N/A

Enumerates physical storage devices

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\svchost.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-6f-27-c5-88-1c\WpadDecisionReason = "1" C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{EF1C3EF9-27A5-4F1B-AC59-3D06AD9A4E66}\32-6f-27-c5-88-1c C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-6f-27-c5-88-1c C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\svchost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{EF1C3EF9-27A5-4F1B-AC59-3D06AD9A4E66}\WpadDecisionTime = e0ee894cd4ccda01 C:\Windows\SysWOW64\svchost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\svchost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{EF1C3EF9-27A5-4F1B-AC59-3D06AD9A4E66}\WpadNetworkName = "Network 3" C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\svchost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-6f-27-c5-88-1c\WpadDecisionTime = e0ee894cd4ccda01 C:\Windows\SysWOW64\svchost.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-6f-27-c5-88-1c\WpadDecision = "0" C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\svchost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 C:\Windows\SysWOW64\svchost.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{EF1C3EF9-27A5-4F1B-AC59-3D06AD9A4E66}\WpadDecisionReason = "1" C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\svchost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{EF1C3EF9-27A5-4F1B-AC59-3D06AD9A4E66} C:\Windows\SysWOW64\svchost.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" C:\Windows\SysWOW64\svchost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\svchost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0039000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings C:\Windows\SysWOW64\svchost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\SysWOW64\svchost.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{EF1C3EF9-27A5-4F1B-AC59-3D06AD9A4E66}\WpadDecision = "0" C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\svchost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" C:\Windows\SysWOW64\svchost.exe N/A

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\temp.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2060 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\1dcad7c8f56207b2c423353f0c328755_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\temp.exe
PID 2060 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\1dcad7c8f56207b2c423353f0c328755_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\temp.exe
PID 2060 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\1dcad7c8f56207b2c423353f0c328755_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\temp.exe
PID 2060 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\1dcad7c8f56207b2c423353f0c328755_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\temp.exe
PID 1972 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 1972 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 1972 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 1972 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 1972 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 1972 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 1972 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 1972 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 1972 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 1972 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 1972 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 1972 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 1972 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 1972 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 1972 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 1972 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 1972 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 1972 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 1972 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 1972 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 1200 wrote to memory of 2764 N/A C:\Windows\Explorer.EXE C:\Windows\system32\sysprep\sysprep.exe
PID 1200 wrote to memory of 2764 N/A C:\Windows\Explorer.EXE C:\Windows\system32\sysprep\sysprep.exe
PID 1200 wrote to memory of 2764 N/A C:\Windows\Explorer.EXE C:\Windows\system32\sysprep\sysprep.exe
PID 2764 wrote to memory of 2740 N/A C:\Windows\system32\sysprep\sysprep.exe C:\Users\Admin\AppData\Local\Temp\net.exe
PID 2764 wrote to memory of 2740 N/A C:\Windows\system32\sysprep\sysprep.exe C:\Users\Admin\AppData\Local\Temp\net.exe
PID 2764 wrote to memory of 2740 N/A C:\Windows\system32\sysprep\sysprep.exe C:\Users\Admin\AppData\Local\Temp\net.exe
PID 2764 wrote to memory of 2740 N/A C:\Windows\system32\sysprep\sysprep.exe C:\Users\Admin\AppData\Local\Temp\net.exe

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\1dcad7c8f56207b2c423353f0c328755_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\1dcad7c8f56207b2c423353f0c328755_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\temp.exe

"C:\Users\Admin\AppData\Local\Temp\temp.exe"

C:\Windows\system32\sysprep\sysprep.exe

"C:\Windows\system32\sysprep\sysprep.exe" "C:\Users\Admin\AppData\Local\Temp\net.exe" "C:\Windows\system32" ""

C:\Users\Admin\AppData\Local\Temp\net.exe

"C:\Users\Admin\AppData\Local\Temp\net.exe"

C:\Windows\SysWOW64\svchost.exe

C:\Windows\SysWOW64\svchost.exe -k netsvcs

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.microsoft.com udp
BE 23.55.97.181:80 www.microsoft.com tcp
BE 23.55.97.181:443 www.microsoft.com tcp
BE 23.55.97.181:443 www.microsoft.com tcp
BE 23.55.97.181:443 www.microsoft.com tcp

Files

\Users\Admin\AppData\Local\Temp\temp.exe

MD5 425609a2c35081730982a01d72a76cbe
SHA1 64f95fe985a7ef7ee4f396e36279aa31498ac3cc
SHA256 e03145fefe7fef82c2a476d7dec03305d7da79cd3c8fe1578177580175febbd3
SHA512 6ede1415ac51d588a71bfb5697a599eb777e9530240b7a3524626d2a230bb51017c9b3d05923c5cb41800cca9818f2d99484310390a0425ef8e48984c4c9cfd4

memory/1200-28-0x0000000003C10000-0x0000000003C11000-memory.dmp

memory/1200-13-0x0000000002E70000-0x0000000002E71000-memory.dmp

memory/1200-7-0x0000000002D80000-0x0000000002D81000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\net.exe

MD5 81d92e20f3078bd8e43b226308393e43
SHA1 5ba8d0e1c1018b6d423607f66f6356d5c4f22a9c
SHA256 e2ff053ae52d37c2334cb0c5b94ea7338a38c396590bfad5e443e7fbd8cd0ddb
SHA512 45d42b3211f8daa1582143e0461ab53d279fab5635120d9c78f8cb105ac7b7c902fe411459ed333a5042696573ce6a29be05726e3f37d89ae0f3be7695409f94

C:\Windows\system\config_t.dat

MD5 2d1847a5ec90424eabcd942cf13702c2
SHA1 c5b77a0d25c77fb755ac1e4fad8f67f64973bb11
SHA256 479822dbaade546dea5281716ea01aafa5d60b8d6c1fa4a5491e50a331cd9605
SHA512 20b86a9a3849dcd819544248def2a258490ef9b7c306f7fdcda3403464f638d557ab3f752a846495dfb9d5b95d31096fa3bc29981dcbc052afd3ddfda5ac5b72

\??\c:\windows\SysWOW64\fastuserswitchingcompatibilityex.dll

MD5 150a2c1b800c6370f9c8a3781568ef83
SHA1 6cc2aed29b672b7026c0fabd3285984488aaeaf3
SHA256 e5f0e0a014e19a8aef99286e6bfd04b7c1258f5a2a5ce2b3ef5d96ec0ac60be3
SHA512 54ffa28ccfcfe3f16078a4a7eaf8f9b10718082bbdb5148c0a2219ff556002105e49c3e88605ef11bbab45f0a704777c10195bfbe93179d6d27c616ea7b37538

C:\Windows\system\config_t.dat

MD5 af03e67b347623a98d7500c6abd4edb3
SHA1 ff4b78601ff11b0fb384aa9611c12600a32f98a3
SHA256 f3e51e226ba602bbce385c3cd26996c6f4994ce6130c16789b40bc253c8adf76
SHA512 9ceca74ec762d7abb42a279835ab358c04b97f448962bbb57795cadedb526c974328402fe200fb312a5caab14b459e183f82bfd45976f0ecc3896803143933ee

C:\Windows\SysWOW64\svchost.log

MD5 2390194525202c8765ba020425106831
SHA1 ecd3c6e0d58b6e03035a412cf8b4da57466ba197
SHA256 75f7a507977bb9e9c2965a305aebfa3797db89d8e9ab3fc355c6e2a066d65e8f
SHA512 d56d46324bd7cf4ccb28860168e88db05bc7920c5e5c062782b46d4dd1debed7d0dde67e870da561ece3758f013b0629effef6977ed7985d323d1f1b85657a6a

C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Windows\Temp\Tar1AD6.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 54cad90359b403a2cba5356c30b42fd8
SHA1 57bd21caf0ad429a4d52ffedda946da11748d26a
SHA256 1f4604a22faacff1ef642c942613cf332692493a77b8295466abfb08a2648e51
SHA512 8a012df5d4f8306e9222384d41ae3c6086cbaa6b7cdd25e0baa12f91803c2aac128cf05dcb5d7eb604a9502b6f1d77d8c91c11b184250023136d4270b18c801f

C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Windows\SysWOW64\svchost.log

MD5 e3588ce50c5868bd437329a8055e2e66
SHA1 bd95641325ce5b6d75caceb967adb12e4f7284b6
SHA256 e6a6ccbe94fb774f2ff8d6f1ec241eb671329995fc0859dc412bcea152ce22ca
SHA512 27e8454012d029eba0911fd25443bf99396a5be566862d658d1aba604075cfecd4a820170db53cff010f03a3a51696e9bb7b25031dac2197ccb790812fd1547a

C:\Windows\SysWOW64\svchost.log

MD5 0ed3925273b89b90af8a22207618aeda
SHA1 87e790b720e236465eb64c36daf5c2c133597eac
SHA256 2723a400131f808f2c00a39a2403b9ce27ef0a55a77b57ceb242a0bc3cb13b46
SHA512 26ce79a6a35637ea7ea9e55e487560587908ee386cc689d50b37882309ac1c9c897de36b019d3b4017bc92741a7b89a796cc43775fe88545d81ec5ae6a4eeba0

C:\Windows\SysWOW64\svchost.log

MD5 538d4af2d9288c327e5225e49ef4e15a
SHA1 4743aab5f8139ab955a1239431b83d1016af9624
SHA256 da462aeb56f9f4de3abd5931e18fc4906f6877bb33ffb8766d957f18c7b497ee
SHA512 21ebf98f53d77216e267d44480bdd395ccb66e93ddca3e9c30928fd70f76a12e5b665b815ef968160fe64e0ee42fa404a2f31018e21876a9b4a8a42ab020a73a

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-02 23:05

Reported

2024-07-02 23:07

Platform

win10v2004-20240611-en

Max time kernel

138s

Max time network

125s

Command Line

C:\Windows\Explorer.EXE

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1dcad7c8f56207b2c423353f0c328755_JaffaCakes118.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\temp.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\sysprep\Panther\setupact.log C:\Windows\system32\sysprep\sysprep.exe N/A
File opened for modification C:\Windows\system32\sysprep\Panther\setuperr.log C:\Windows\system32\sysprep\sysprep.exe N/A
File opened for modification C:\Windows\system32\sysprep\Panther\diagerr.xml C:\Windows\system32\sysprep\sysprep.exe N/A
File opened for modification C:\Windows\system32\sysprep\Panther\diagwrn.xml C:\Windows\system32\sysprep\sysprep.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Users\Admin\AppData\Local\Temp\1dcad7c8f56207b2c423353f0c328755_JaffaCakes118.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\temp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\temp.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3620 wrote to memory of 624 N/A C:\Users\Admin\AppData\Local\Temp\1dcad7c8f56207b2c423353f0c328755_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\temp.exe
PID 3620 wrote to memory of 624 N/A C:\Users\Admin\AppData\Local\Temp\1dcad7c8f56207b2c423353f0c328755_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\temp.exe
PID 624 wrote to memory of 3608 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 624 wrote to memory of 3608 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 624 wrote to memory of 3608 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 624 wrote to memory of 3608 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 624 wrote to memory of 3608 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 624 wrote to memory of 3608 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 624 wrote to memory of 3608 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 624 wrote to memory of 3608 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 624 wrote to memory of 3608 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 624 wrote to memory of 3608 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 624 wrote to memory of 3608 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 624 wrote to memory of 3608 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 624 wrote to memory of 3608 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 624 wrote to memory of 3608 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 624 wrote to memory of 3608 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 624 wrote to memory of 3608 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 624 wrote to memory of 3608 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 624 wrote to memory of 3608 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 624 wrote to memory of 3608 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 624 wrote to memory of 3608 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\Explorer.EXE
PID 3608 wrote to memory of 1576 N/A C:\Windows\Explorer.EXE C:\Windows\system32\sysprep\sysprep.exe
PID 3608 wrote to memory of 1576 N/A C:\Windows\Explorer.EXE C:\Windows\system32\sysprep\sysprep.exe

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\1dcad7c8f56207b2c423353f0c328755_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\1dcad7c8f56207b2c423353f0c328755_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\temp.exe

"C:\Users\Admin\AppData\Local\Temp\temp.exe"

C:\Windows\system32\sysprep\sysprep.exe

"C:\Windows\system32\sysprep\sysprep.exe" "C:\Users\Admin\AppData\Local\Temp\net.exe" "C:\Windows\system32" ""

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 203.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 92.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\temp.exe

MD5 425609a2c35081730982a01d72a76cbe
SHA1 64f95fe985a7ef7ee4f396e36279aa31498ac3cc
SHA256 e03145fefe7fef82c2a476d7dec03305d7da79cd3c8fe1578177580175febbd3
SHA512 6ede1415ac51d588a71bfb5697a599eb777e9530240b7a3524626d2a230bb51017c9b3d05923c5cb41800cca9818f2d99484310390a0425ef8e48984c4c9cfd4

memory/3608-62-0x0000000002B00000-0x0000000002B01000-memory.dmp

memory/3608-61-0x00000000029F0000-0x00000000029F1000-memory.dmp