d2d218900f7eabbebce801f218f9e1a322b75e814d7493bfc9133d2fcfb5f044

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 06:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3393b655bbb5cab9f1b3aa45bb6346cf_JaffaCakes118.exe
Size

613KB
MD5

3393b655bbb5cab9f1b3aa45bb6346cf
SHA1

4fb0aee74e7d08b7265df2f22112cee1a3138874
SHA256

d2d218900f7eabbebce801f218f9e1a322b75e814d7493bfc9133d2fcfb5f044
SHA512

5a78c5081ae0f99508bdbc282fc39af8de6d567522bcac5d8b07e2900e01576d9faab689abb2fbd56728ab60beb2a01352a7979d6827c959ce579880d100edce
SSDEEP

12288:vniayqhPkJeeZ4gvSFAULoSRJtFZu6P6go9BdFyemmL667W7pKvz6Y9zz5m:vniT5ZLEoSFFnkdcemF7Gb1z4

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2824	cmd.exe

Executes dropped EXE 4 IoCs

pid	Process
2884	KSWebShield.exe
2604	KSWebShield.exe
2404	KSWebShield.exe
1956	KSWebShield.exe

Loads dropped DLL 18 IoCs

pid	Process
2084	3393b655bbb5cab9f1b3aa45bb6346cf_JaffaCakes118.exe
2084	3393b655bbb5cab9f1b3aa45bb6346cf_JaffaCakes118.exe
2084	3393b655bbb5cab9f1b3aa45bb6346cf_JaffaCakes118.exe
2084	3393b655bbb5cab9f1b3aa45bb6346cf_JaffaCakes118.exe
2732	cmd.exe
2084	3393b655bbb5cab9f1b3aa45bb6346cf_JaffaCakes118.exe
2084	3393b655bbb5cab9f1b3aa45bb6346cf_JaffaCakes118.exe
2732	cmd.exe
2884	KSWebShield.exe
2884	KSWebShield.exe
2732	cmd.exe
2732	cmd.exe
2604	KSWebShield.exe
2604	KSWebShield.exe
2404	KSWebShield.exe
2404	KSWebShield.exe
1956	KSWebShield.exe
1956	KSWebShield.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File created	C:\Users\Public\Desktop\Internat Explorar\Desktop.ini	3393b655bbb5cab9f1b3aa45bb6346cf_JaffaCakes118.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\tbgw.ico	3393b655bbb5cab9f1b3aa45bb6346cf_JaffaCakes118.exe
File opened for modification	C:\Windows\tbgw.ico	3393b655bbb5cab9f1b3aa45bb6346cf_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2084	3393b655bbb5cab9f1b3aa45bb6346cf_JaffaCakes118.exe
2084	3393b655bbb5cab9f1b3aa45bb6346cf_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2884	KSWebShield.exe
Token: SeDebugPrivilege	2604	KSWebShield.exe
Token: SeDebugPrivilege	2404	KSWebShield.exe
Token: 33	2404	KSWebShield.exe
Token: SeIncBasePriorityPrivilege	2404	KSWebShield.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1956	KSWebShield.exe
1956	KSWebShield.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 2732	2084	3393b655bbb5cab9f1b3aa45bb6346cf_JaffaCakes118.exe	30
PID 2084 wrote to memory of 2732	2084	3393b655bbb5cab9f1b3aa45bb6346cf_JaffaCakes118.exe	30
PID 2084 wrote to memory of 2732	2084	3393b655bbb5cab9f1b3aa45bb6346cf_JaffaCakes118.exe	30
PID 2084 wrote to memory of 2732	2084	3393b655bbb5cab9f1b3aa45bb6346cf_JaffaCakes118.exe	30
PID 2084 wrote to memory of 2732	2084	3393b655bbb5cab9f1b3aa45bb6346cf_JaffaCakes118.exe	30
PID 2084 wrote to memory of 2732	2084	3393b655bbb5cab9f1b3aa45bb6346cf_JaffaCakes118.exe	30
PID 2084 wrote to memory of 2732	2084	3393b655bbb5cab9f1b3aa45bb6346cf_JaffaCakes118.exe	30
PID 2084 wrote to memory of 2848	2084	3393b655bbb5cab9f1b3aa45bb6346cf_JaffaCakes118.exe	32
PID 2084 wrote to memory of 2848	2084	3393b655bbb5cab9f1b3aa45bb6346cf_JaffaCakes118.exe	32
PID 2084 wrote to memory of 2848	2084	3393b655bbb5cab9f1b3aa45bb6346cf_JaffaCakes118.exe	32
PID 2084 wrote to memory of 2848	2084	3393b655bbb5cab9f1b3aa45bb6346cf_JaffaCakes118.exe	32
PID 2084 wrote to memory of 2848	2084	3393b655bbb5cab9f1b3aa45bb6346cf_JaffaCakes118.exe	32
PID 2084 wrote to memory of 2848	2084	3393b655bbb5cab9f1b3aa45bb6346cf_JaffaCakes118.exe	32
PID 2084 wrote to memory of 2848	2084	3393b655bbb5cab9f1b3aa45bb6346cf_JaffaCakes118.exe	32
PID 2732 wrote to memory of 2884	2732	cmd.exe	34
PID 2732 wrote to memory of 2884	2732	cmd.exe	34
PID 2732 wrote to memory of 2884	2732	cmd.exe	34
PID 2732 wrote to memory of 2884	2732	cmd.exe	34
PID 2732 wrote to memory of 2884	2732	cmd.exe	34
PID 2732 wrote to memory of 2884	2732	cmd.exe	34
PID 2732 wrote to memory of 2884	2732	cmd.exe	34
PID 2732 wrote to memory of 2604	2732	cmd.exe	35
PID 2732 wrote to memory of 2604	2732	cmd.exe	35
PID 2732 wrote to memory of 2604	2732	cmd.exe	35
PID 2732 wrote to memory of 2604	2732	cmd.exe	35
PID 2732 wrote to memory of 2604	2732	cmd.exe	35
PID 2732 wrote to memory of 2604	2732	cmd.exe	35
PID 2732 wrote to memory of 2604	2732	cmd.exe	35
PID 2404 wrote to memory of 1956	2404	KSWebShield.exe	37
PID 2404 wrote to memory of 1956	2404	KSWebShield.exe	37
PID 2404 wrote to memory of 1956	2404	KSWebShield.exe	37
PID 2404 wrote to memory of 1956	2404	KSWebShield.exe	37
PID 2084 wrote to memory of 2824	2084	3393b655bbb5cab9f1b3aa45bb6346cf_JaffaCakes118.exe	38
PID 2084 wrote to memory of 2824	2084	3393b655bbb5cab9f1b3aa45bb6346cf_JaffaCakes118.exe	38
PID 2084 wrote to memory of 2824	2084	3393b655bbb5cab9f1b3aa45bb6346cf_JaffaCakes118.exe	38
PID 2084 wrote to memory of 2824	2084	3393b655bbb5cab9f1b3aa45bb6346cf_JaffaCakes118.exe	38
PID 2084 wrote to memory of 2824	2084	3393b655bbb5cab9f1b3aa45bb6346cf_JaffaCakes118.exe	38
PID 2084 wrote to memory of 2824	2084	3393b655bbb5cab9f1b3aa45bb6346cf_JaffaCakes118.exe	38
PID 2084 wrote to memory of 2824	2084	3393b655bbb5cab9f1b3aa45bb6346cf_JaffaCakes118.exe	38

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2848	attrib.exe

C:\Users\Admin\AppData\Local\Temp\3393b655bbb5cab9f1b3aa45bb6346cf_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3393b655bbb5cab9f1b3aa45bb6346cf_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\ProgramData\wd\l.bat" "
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2732
- - C:\ProgramData\wd\KSWebShield.exe
    KSWebShield.exe -install
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:2884
- - C:\ProgramData\wd\KSWebShield.exe
    KSWebShield.exe -start
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:2604
- C:\Windows\SysWOW64\attrib.exe
  "C:\Windows\System32\attrib.exe" "C:\Users\Public\Desktop\Internat Explorar" +s
  2⤵
  - Views/modifies file attributes
  PID:2848
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\temp_tmp.bat" "
  2⤵
  - Deletes itself
  PID:2824

C:\ProgramData\wd\KSWebShield.exe
C:\ProgramData\wd\KSWebShield.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2404
- C:\ProgramData\wd\KSWebShield.exe
  C:\ProgramData\wd\KSWebShield.exe -run
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\WD\KWSSVC.log

Filesize
202B

MD5
12f3ad5b1a6d6c5758131f81bb361d0b

SHA1
90c2929d8739a66ea3a05248f61463f4eb73cf6c

SHA256
d3436ff6f06ab84db14aed6bbe5c45e5220c141159e7fea1ea3d0ad9fc062d58

SHA512
ef41bc73ca2f038a02c03dbf0eb2a18796dc8cac5a1898cae7a7398aa19a70be8637e563b4627379d640a0875beec71668ee659361a0795a87d25a3c44150f09

Download Submit
C:\ProgramData\WD\KWSSVC.log

Filesize
546B

MD5
5553c34fa290f48385d62fdc88fadac2

SHA1
908cd4d132e738067e7f8d490304db7c86e0e24e

SHA256
6c07825ca16ba9d492d0af07b879b1890c03d70742ef1a07af4dec7fcef40a38

SHA512
46506c68f5069b6cc4029513cb15271da37da56a17afeb7193dab1d5c30738abb3bf6563b1e6c052cacd35f3e3e73a190e1c586683ed0591f5b97f51ac1ad2ed

Download Submit
C:\ProgramData\WD\l.bat

Filesize
61B

MD5
416a24d745052befd1631b58be5762c6

SHA1
ca78b420e1e4cd13b9603619ebb7cb07e72e4a7e

SHA256
b6da900a03255d186babcc480d39483d6a4af6498b069888cc1914f83e964706

SHA512
873b80b9a48cb7097315732f3ae0f53fa8b315c2c8f9b900e9e880476b5971f62ef8eda676c3d0ec27d6a3fd166eb712af092e4dcb011f402ff4a2c3650b91f8

Download Submit
C:\ProgramData\kingsoft\kws\kws.ini

Filesize
449B

MD5
df02a8a4632363f124eb695f6305df64

SHA1
685276d87352e79ff757713cef4c956a6b85e398

SHA256
304e01cb2b422f4315080432b47596cacf7735aa622336504cedc42a20a7cea8

SHA512
2dee87859ebdf01104802ddd7ff66a529ecaed2943973648c918d0dc7c0aefac1e82f7b82613404a44af49aa7c9a50d9c4d4ede581f128a81da1c17ba3430931

Download Submit
C:\ProgramData\wd\kswebshield.dll

Filesize
441KB

MD5
7851449473178f9782263d51bc5e3bbc

SHA1
ad5148ee1bed2348b320c62c025d52fbcbb28799

SHA256
c3bc7ec8428f0bb210a0597c9a0cad1be412b7fa46ea006819a3df9ac23118b4

SHA512
b01fc37ac84b81df8d7657000295aed7eb50aaf7f13ab2b2be9030c9f83ed1559318c83c78b4a29926d7d30e9eea9538d123ef4a649179be5a5b54ee71ed9b49

Download Submit
C:\ProgramData\wd\kwssp.dll

Filesize
425KB

MD5
bf5dcfd9da0514334d41cbd80d2a9138

SHA1
802f9e0b82edca56be08a33b2ba874b34c31f1e3

SHA256
f9506cf9a87aa6bfbf07f2124f2785a711b27a70839ebb95bdd4b2cf747fb060

SHA512
246796f2e201cde30043eaa2c0ffb4d2b3bea2bae97261a022824c31a42d2b08998b1bdcd436e8392bdd153dd6fadf9ba69361c7316a6bfda5d475678b7aa5cc

Download Submit
C:\ProgramData\wd\kwsui.dll

Filesize
433KB

MD5
45199dab51eeece95728abfe25e18f35

SHA1
59ab0fe25aa2adc253adbecba6862e7432df1c39

SHA256
a22006861cac6a849346282e2f7729deeb8f68bf29f13c15ae33d20311f77391

SHA512
825c6ae1f88cec3d6c469e6a15cad0430845ecc8d436777092f4c5fe8ecd02abbfeb3e2a17b2f4896b9d6e4b2d229a8b83bfdda75a3e025fc32f86610c6eef12

Download Submit
C:\Users\Admin\AppData\Local\Temp\temp_tmp.bat

Filesize
225B

MD5
00c9d6274f5289b802adcb4f37cc6c10

SHA1
4da42dadde77e9787d569885481e676b6085b89a

SHA256
5ba08cdcb1339090d812f2c3f2bc7e0a24aff028da928c49b821e11bcf927463

SHA512
9b9743b7c7ddf7801b53fd757171bad6d0bf02ae390b0804c552e51f2786d4054b6d5c58cb6b9730b4e64d434a4824dae4090492335add705a5da0a1795daf09

Download Submit
C:\Users\Public\Desktop\ÌÔ±¦Íø¹º.lnk

Filesize
1KB

MD5
5ffaf2527bc8e175c988c8dc53dbc484

SHA1
7c069a0e54469453fdc91d57bfb0e82e2e539777

SHA256
2f58298a3e901293b80ad5ebc164e53e76e079c3e86252f1b34f702c55ada96e

SHA512
f90556ed1bd94a994d3a6573757f1214cfacb03ee5d6e1b8d277fb00f95371045e279b3a05189de7baf832605845d11a99196ac85de6c0ce050c611a9ab3b8ba

Download Submit
\ProgramData\WD\KSWebShield.exe

Filesize
209KB

MD5
1fa47f5b173cee5ef9c3ee1bda0c321e

SHA1
60ee40236f960affb01d569a32e1b05888bb081a

SHA256
b21526716068d2a8550780038e2b5ddb843d77890a07ec82ed9ce9dd0be52c64

SHA512
01f39376269a75510347fcf66ff2585b25d5e6e10e26b7feefa3af66e712a5f50c62bff6d40abee733e1ce965d17a2e443664838268eb7c7a2e36fc1c024224d

Download Submit
\Users\Admin\AppData\Local\Temp\nst95EB.tmp\AccessControl.dll

Filesize
10KB

MD5
055f4f9260e07fc83f71877cbb7f4fad

SHA1
a245131af1a182de99bd74af9ff1fab17977a72f

SHA256
4209588362785b690d08d15cd982b8d1c62c348767ca19114234b21d5df74ddc

SHA512
a8e82dc4435ed938f090f43df953ddad9b0075f16218c09890c996299420162d64b1dbfbf613af37769ae796717eec78204dc786b757e8b1d13d423d4ee82e26

Download Submit
\Users\Admin\AppData\Local\Temp\nst95EB.tmp\FindProcDLL.dll

Filesize
3KB

MD5
8614c450637267afacad1645e23ba24a

SHA1
e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2

SHA256
0fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758

SHA512
af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b

Download Submit
memory/1956-87-0x0000000000260000-0x00000000002D1000-memory.dmp

Filesize
452KB

Download
memory/2084-5-0x0000000010000000-0x0000000010003000-memory.dmp

Filesize
12KB

Download