f458448d405a41c8075cd24c8f5aaed869db692f8ec60ad9a1e21dd8f9501e5b

Analysis

max time kernel
144s
max time network
147s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 02:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
20c1ca433d6b53e4bfdfae2fffb52a2c_JaffaCakes118.exe
Size 78KB
Sample240703-cts8lswhnn
SHA256 f458448d405a41c8075cd24c8f5aaed869db692f8ec60ad9a1e21dd8f9501e5b
MD5 20c1ca433d6b53e4bfdfae2fffb52a2c
SHA1 647787803633f6b6c207a9ff355654c0517b7e67
SHA512 9b996bc1970489dc3c144ecc53aec67497b393a738f761cfa4624ad1265615ba7b14aed181ec08a485758e51c0230190a170a4d40c45181c797da135b8e5cf9e
SSDEEP 1536:HhRWV5jLXT0XRhyRjVf3znOJTv3lcUK/+dWzCP7oYTcSQt96p9/eXo1RE:BRWV5jLSyRxvY3md+dWWZye9/O3
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2736	tmp14C8.tmp.exe

Loads dropped DLL 2 IoCs

pid	Process
3000	20c1ca433d6b53e4bfdfae2fffb52a2c_JaffaCakes118.exe
3000	20c1ca433d6b53e4bfdfae2fffb52a2c_JaffaCakes118.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\ShFusRes = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\big5.exe\""	tmp14C8.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3000	20c1ca433d6b53e4bfdfae2fffb52a2c_JaffaCakes118.exe
Token: SeDebugPrivilege	2736	tmp14C8.tmp.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 2968	3000	20c1ca433d6b53e4bfdfae2fffb52a2c_JaffaCakes118.exe	28
PID 3000 wrote to memory of 2968	3000	20c1ca433d6b53e4bfdfae2fffb52a2c_JaffaCakes118.exe	28
PID 3000 wrote to memory of 2968	3000	20c1ca433d6b53e4bfdfae2fffb52a2c_JaffaCakes118.exe	28
PID 3000 wrote to memory of 2968	3000	20c1ca433d6b53e4bfdfae2fffb52a2c_JaffaCakes118.exe	28
PID 2968 wrote to memory of 2608	2968	vbc.exe	30
PID 2968 wrote to memory of 2608	2968	vbc.exe	30
PID 2968 wrote to memory of 2608	2968	vbc.exe	30
PID 2968 wrote to memory of 2608	2968	vbc.exe	30
PID 3000 wrote to memory of 2736	3000	20c1ca433d6b53e4bfdfae2fffb52a2c_JaffaCakes118.exe	31
PID 3000 wrote to memory of 2736	3000	20c1ca433d6b53e4bfdfae2fffb52a2c_JaffaCakes118.exe	31
PID 3000 wrote to memory of 2736	3000	20c1ca433d6b53e4bfdfae2fffb52a2c_JaffaCakes118.exe	31
PID 3000 wrote to memory of 2736	3000	20c1ca433d6b53e4bfdfae2fffb52a2c_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\20c1ca433d6b53e4bfdfae2fffb52a2c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\20c1ca433d6b53e4bfdfae2fffb52a2c_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\tl-76vkf.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2968
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1611.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1610.tmp"
    3⤵
    PID:2608
- C:\Users\Admin\AppData\Local\Temp\tmp14C8.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp14C8.tmp.exe" C:\Users\Admin\AppData\Local\Temp\20c1ca433d6b53e4bfdfae2fffb52a2c_JaffaCakes118.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES1611.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES1611.tmp
Size 1KB
SHA256 9d7a03f7ebf73ab94306a79c21aec570f81778dfbcea1c893766ac73cabaafcc
MD5 7fc267adfecc6e90cf714a916ab2b0b3
SHA1 92d79c7a15a0ece124fbb36b40d85591bcd634f5
SHA512 8d9c1fb5a0d88f3c18e4e60f921ea5eac61eafa84ac055ff902d9afac12aef8ae26e595434718aab60a8f4b9cdac9bcf740c8e01ccd446c74b1c39812135834f
MD5 SHA1 SHA512

Submit Download

tl-76vkf.0.vb

Path C:\Users\Admin\AppData\Local\Temp\tl-76vkf.0.vb
Size 14KB
SHA256 cf42d4d318093ba7100a4fe77a7870775d800d061b7ce03408b95195e9488e19
MD5 41a0fad9b064db88d7296a99c9f8d5eb
SHA1 079d1c025ae94e8d662807e35b93f55eacad100d
SHA512 ce1ddc3d3d90095a366806d8aa1f52ad72122615cac60c30f846a364f5d6fd03290fa420ff89eb552077faac83a6c44d2761842dd8fd481bd9f1c5c25a13d5f1
SSDEEP 384:rCNqHN9YUGENQDMWNMKNroNdN4cHbzE6NGzN7QKSN7eP:yqtWUGkQDMKXVQP4cHzGhB+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

tl-76vkf.cmdline

Path C:\Users\Admin\AppData\Local\Temp\tl-76vkf.cmdline
Size 266B
SHA256 db70f303308c81f6f7e4a7b0f2b35f8340815c916e28f1e2abcbf0e8f4b1ea4f
MD5 0447ee2ff1e185fd778b66b8d1b74df4
SHA1 a2665fcf754dab9a74ecfa06c881bb90a91ca5cb
SHA512 4dc8e956ed39e98f744f994619281fc41d99c8cc7f606fbfe1daee1e4c14225e9af40545062a69d699f8d0f047b46fb50f49eaf9e2aafbb6c0802ad22544242e
MD5 SHA1 SHA512

Submit Download

tmp14C8.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp14C8.tmp.exe
Size 78KB
SHA256 c2a046c52f2524268619f580083d23d636fd263721958ecbed5ba4d1d34d691c
MD5 ca290a8953d201fecfc3767a8b482741
SHA1 34bfef4ac7701038b674f0c918dc5b670fc4a651
SHA512 7debe5e7df2cad072cea18cff93f75381eb3608e01cb1554ce45e492bb26a7c57041555fde6110d71261777bc8eb2c7237e35057321b2256c089f29e24b2226d
SSDEEP 1536:mRWtHF3M3xXT0XRhyRjVf3znOJTv3lcUK/+dWzCP7oYTcSQte69J9/hQ1Le:mRWtHF83xSyRxvY3md+dWWZye69J9/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbc1610.tmp

Path C:\Users\Admin\AppData\Local\Temp\vbc1610.tmp
Size 660B
SHA256 8f4f999c099730868de3c31d187de7ce79e2535b79574bfd49d3f762c455b1ca
MD5 cdbd8e5b4a70b49ce38141390269b7a7
SHA1 93599ea243c10d2b46d3da674dd25be151a7fc56
SHA512 d38259d1bc96c22386f10c8f5c4e510c20b1d3050248b5c06bb1d8dafe75e0bc6ad5bff243e8dfd400deb455e77af08bfefaff28749398aaba8c7f6c02eb44a4
MD5 SHA1 SHA512

Submit Download

zCom.resources

Path C:\Users\Admin\AppData\Local\Temp\zCom.resources
Size 62KB
SHA256 e54a257fa391065c120f55841de8c11116ea0e601d90fe1a35dcd340c5dd9cd5
MD5 4f0e8cf79edb6cd381474b21cabfdf4a
SHA1 7018c96b4c5dab7957d4bcdc82c1e7bb3a4f80c4
SHA512 2451a59d09464e30d0df822d9322dbecb83faa92c5a5b71b7b9db62330c40cc7570d66235f137290074a3c4a9f3d8b3447067ed135f1bb60ea9e18d0df39a107
SSDEEP 1536:3XT0XRhyRjVf3znOJTv3lcUK/+dWzCP7oYTcSQtQ:nSyRxvY3md+dWWZyQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2968-8-0x00000000740D0000-0x000000007467B000-memory.dmp

Download

memory/2968-18-0x00000000740D0000-0x000000007467B000-memory.dmp

Download

memory/3000-0-0x00000000740D1000-0x00000000740D2000-memory.dmp

Download

memory/3000-1-0x00000000740D0000-0x000000007467B000-memory.dmp

Download

memory/3000-2-0x00000000740D0000-0x000000007467B000-memory.dmp

Download

memory/3000-24-0x00000000740D0000-0x000000007467B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads