d2d218900f7eabbebce801f218f9e1a322b75e814d7493bfc9133d2fcfb5f044

Analysis

max time kernel
120s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 06:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3393b655bbb5cab9f1b3aa45bb6346cf_JaffaCakes118.exe
Size

613KB
MD5

3393b655bbb5cab9f1b3aa45bb6346cf
SHA1

4fb0aee74e7d08b7265df2f22112cee1a3138874
SHA256

d2d218900f7eabbebce801f218f9e1a322b75e814d7493bfc9133d2fcfb5f044
SHA512

5a78c5081ae0f99508bdbc282fc39af8de6d567522bcac5d8b07e2900e01576d9faab689abb2fbd56728ab60beb2a01352a7979d6827c959ce579880d100edce
SSDEEP

12288:vniayqhPkJeeZ4gvSFAULoSRJtFZu6P6go9BdFyemmL667W7pKvz6Y9zz5m:vniT5ZLEoSFFnkdcemF7Gb1z4

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Control Panel\International\Geo\Nation	3393b655bbb5cab9f1b3aa45bb6346cf_JaffaCakes118.exe

Executes dropped EXE 4 IoCs

pid	Process
3212	KSWebShield.exe
1468	KSWebShield.exe
3708	KSWebShield.exe
3256	KSWebShield.exe

Loads dropped DLL 13 IoCs

pid	Process
3264	3393b655bbb5cab9f1b3aa45bb6346cf_JaffaCakes118.exe
3264	3393b655bbb5cab9f1b3aa45bb6346cf_JaffaCakes118.exe
3264	3393b655bbb5cab9f1b3aa45bb6346cf_JaffaCakes118.exe
3264	3393b655bbb5cab9f1b3aa45bb6346cf_JaffaCakes118.exe
3264	3393b655bbb5cab9f1b3aa45bb6346cf_JaffaCakes118.exe
3264	3393b655bbb5cab9f1b3aa45bb6346cf_JaffaCakes118.exe
3708	KSWebShield.exe
3256	KSWebShield.exe
3256	KSWebShield.exe
3256	KSWebShield.exe
3264	3393b655bbb5cab9f1b3aa45bb6346cf_JaffaCakes118.exe
3264	3393b655bbb5cab9f1b3aa45bb6346cf_JaffaCakes118.exe
3264	3393b655bbb5cab9f1b3aa45bb6346cf_JaffaCakes118.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File created	C:\Users\Public\Desktop\Internat Explorar\Desktop.ini	3393b655bbb5cab9f1b3aa45bb6346cf_JaffaCakes118.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\tbgw.ico	3393b655bbb5cab9f1b3aa45bb6346cf_JaffaCakes118.exe
File opened for modification	C:\Windows\tbgw.ico	3393b655bbb5cab9f1b3aa45bb6346cf_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3264	3393b655bbb5cab9f1b3aa45bb6346cf_JaffaCakes118.exe
3264	3393b655bbb5cab9f1b3aa45bb6346cf_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3212	KSWebShield.exe
Token: SeDebugPrivilege	1468	KSWebShield.exe
Token: SeDebugPrivilege	3708	KSWebShield.exe
Token: 33	3708	KSWebShield.exe
Token: SeIncBasePriorityPrivilege	3708	KSWebShield.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3256	KSWebShield.exe
3256	KSWebShield.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 3264 wrote to memory of 2084	3264	3393b655bbb5cab9f1b3aa45bb6346cf_JaffaCakes118.exe	84
PID 3264 wrote to memory of 2084	3264	3393b655bbb5cab9f1b3aa45bb6346cf_JaffaCakes118.exe	84
PID 3264 wrote to memory of 2084	3264	3393b655bbb5cab9f1b3aa45bb6346cf_JaffaCakes118.exe	84
PID 3264 wrote to memory of 3700	3264	3393b655bbb5cab9f1b3aa45bb6346cf_JaffaCakes118.exe	86
PID 3264 wrote to memory of 3700	3264	3393b655bbb5cab9f1b3aa45bb6346cf_JaffaCakes118.exe	86
PID 3264 wrote to memory of 3700	3264	3393b655bbb5cab9f1b3aa45bb6346cf_JaffaCakes118.exe	86
PID 2084 wrote to memory of 3212	2084	cmd.exe	88
PID 2084 wrote to memory of 3212	2084	cmd.exe	88
PID 2084 wrote to memory of 3212	2084	cmd.exe	88
PID 2084 wrote to memory of 1468	2084	cmd.exe	89
PID 2084 wrote to memory of 1468	2084	cmd.exe	89
PID 2084 wrote to memory of 1468	2084	cmd.exe	89
PID 3708 wrote to memory of 3256	3708	KSWebShield.exe	91
PID 3708 wrote to memory of 3256	3708	KSWebShield.exe	91
PID 3708 wrote to memory of 3256	3708	KSWebShield.exe	91
PID 3264 wrote to memory of 4544	3264	3393b655bbb5cab9f1b3aa45bb6346cf_JaffaCakes118.exe	93
PID 3264 wrote to memory of 4544	3264	3393b655bbb5cab9f1b3aa45bb6346cf_JaffaCakes118.exe	93
PID 3264 wrote to memory of 4544	3264	3393b655bbb5cab9f1b3aa45bb6346cf_JaffaCakes118.exe	93

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
3700	attrib.exe

C:\Users\Admin\AppData\Local\Temp\3393b655bbb5cab9f1b3aa45bb6346cf_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3393b655bbb5cab9f1b3aa45bb6346cf_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3264
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\ProgramData\wd\l.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2084
- - C:\ProgramData\wd\KSWebShield.exe
    KSWebShield.exe -install
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3212
- - C:\ProgramData\wd\KSWebShield.exe
    KSWebShield.exe -start
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1468
- C:\Windows\SysWOW64\attrib.exe
  "C:\Windows\System32\attrib.exe" "C:\Users\Public\Desktop\Internat Explorar" +s
  2⤵
  - Views/modifies file attributes
  PID:3700
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\temp_tmp.bat" "
  2⤵
  PID:4544

C:\ProgramData\wd\KSWebShield.exe
C:\ProgramData\wd\KSWebShield.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3708
- C:\ProgramData\wd\KSWebShield.exe
  C:\ProgramData\wd\KSWebShield.exe -run
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:3256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\WD\KSWebShield.exe

Filesize
209KB

MD5
1fa47f5b173cee5ef9c3ee1bda0c321e

SHA1
60ee40236f960affb01d569a32e1b05888bb081a

SHA256
b21526716068d2a8550780038e2b5ddb843d77890a07ec82ed9ce9dd0be52c64

SHA512
01f39376269a75510347fcf66ff2585b25d5e6e10e26b7feefa3af66e712a5f50c62bff6d40abee733e1ce965d17a2e443664838268eb7c7a2e36fc1c024224d

Download Submit
C:\ProgramData\WD\KWSSVC.log

Filesize
202B

MD5
821e728c3f49039e888e0be23d3089d3

SHA1
c71cd985cca09728fc01893f0e330fad7100d9b0

SHA256
3f5b3288dbc7d0b313d323e72b9c2a22d1b51cf44e0094fa052fa9c549c9030b

SHA512
954d7a269c764b80f3105f23294c0350e8970ffd263255107b1023fbcdc7ed6fd4eeb1438020a0b9bd1e3ac2cdad674ae1dc6cd53ee05e28cb61c1424e36aceb

Download Submit
C:\ProgramData\WD\KWSSVC.log

Filesize
356B

MD5
fd9f9cdbef45a4626930ae40320af95e

SHA1
da21030eb694606fb37929f38572c1d4804e4191

SHA256
96684e6721393724225a71e17539478a2717d95c4a391ebf9a697ab1c7d3f37f

SHA512
f8e77151840d216909dd143dd5e44b137cfefe14e5bf3f9bff3bdf10fb029d2c78bd8a33589808a206f7682f6e802e819386dd6c9e96206d933147509178d2f5

Download Submit
C:\ProgramData\WD\KWSSVC.log

Filesize
546B

MD5
56dec7a49a9f3aca1a737f3dbca9d6d2

SHA1
75c6dc2f3002f4d4f67d387f248d57f8b483d7d1

SHA256
7f93baf1f77d6e0dc6802f654d9002b4bd83bfe51d37918d6419fcfc1acbd5c5

SHA512
29be751db5b3b72f13b6901efeb32336dbc39be8c014a78fc630f0f24d626eeddc43a4aa263cefc151bcd4f181a89952a9ddc784592b11b9f7f81b900add2b20

Download Submit
C:\ProgramData\kingsoft\kws\kws.ini

Filesize
449B

MD5
df02a8a4632363f124eb695f6305df64

SHA1
685276d87352e79ff757713cef4c956a6b85e398

SHA256
304e01cb2b422f4315080432b47596cacf7735aa622336504cedc42a20a7cea8

SHA512
2dee87859ebdf01104802ddd7ff66a529ecaed2943973648c918d0dc7c0aefac1e82f7b82613404a44af49aa7c9a50d9c4d4ede581f128a81da1c17ba3430931

Download Submit
C:\ProgramData\wd\kswebshield.dll

Filesize
441KB

MD5
7851449473178f9782263d51bc5e3bbc

SHA1
ad5148ee1bed2348b320c62c025d52fbcbb28799

SHA256
c3bc7ec8428f0bb210a0597c9a0cad1be412b7fa46ea006819a3df9ac23118b4

SHA512
b01fc37ac84b81df8d7657000295aed7eb50aaf7f13ab2b2be9030c9f83ed1559318c83c78b4a29926d7d30e9eea9538d123ef4a649179be5a5b54ee71ed9b49

Download Submit
C:\ProgramData\wd\kwssp.dll

Filesize
425KB

MD5
bf5dcfd9da0514334d41cbd80d2a9138

SHA1
802f9e0b82edca56be08a33b2ba874b34c31f1e3

SHA256
f9506cf9a87aa6bfbf07f2124f2785a711b27a70839ebb95bdd4b2cf747fb060

SHA512
246796f2e201cde30043eaa2c0ffb4d2b3bea2bae97261a022824c31a42d2b08998b1bdcd436e8392bdd153dd6fadf9ba69361c7316a6bfda5d475678b7aa5cc

Download Submit
C:\ProgramData\wd\kwsui.dll

Filesize
433KB

MD5
45199dab51eeece95728abfe25e18f35

SHA1
59ab0fe25aa2adc253adbecba6862e7432df1c39

SHA256
a22006861cac6a849346282e2f7729deeb8f68bf29f13c15ae33d20311f77391

SHA512
825c6ae1f88cec3d6c469e6a15cad0430845ecc8d436777092f4c5fe8ecd02abbfeb3e2a17b2f4896b9d6e4b2d229a8b83bfdda75a3e025fc32f86610c6eef12

Download Submit
C:\ProgramData\wd\l.bat

Filesize
61B

MD5
416a24d745052befd1631b58be5762c6

SHA1
ca78b420e1e4cd13b9603619ebb7cb07e72e4a7e

SHA256
b6da900a03255d186babcc480d39483d6a4af6498b069888cc1914f83e964706

SHA512
873b80b9a48cb7097315732f3ae0f53fa8b315c2c8f9b900e9e880476b5971f62ef8eda676c3d0ec27d6a3fd166eb712af092e4dcb011f402ff4a2c3650b91f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi8ED4.tmp\AccessControl.dll

Filesize
10KB

MD5
055f4f9260e07fc83f71877cbb7f4fad

SHA1
a245131af1a182de99bd74af9ff1fab17977a72f

SHA256
4209588362785b690d08d15cd982b8d1c62c348767ca19114234b21d5df74ddc

SHA512
a8e82dc4435ed938f090f43df953ddad9b0075f16218c09890c996299420162d64b1dbfbf613af37769ae796717eec78204dc786b757e8b1d13d423d4ee82e26

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi8ED4.tmp\FindProcDLL.dll

Filesize
3KB

MD5
8614c450637267afacad1645e23ba24a

SHA1
e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2

SHA256
0fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758

SHA512
af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b

Download Submit
C:\Users\Admin\AppData\Local\Temp\temp_tmp.bat

Filesize
225B

MD5
00c9d6274f5289b802adcb4f37cc6c10

SHA1
4da42dadde77e9787d569885481e676b6085b89a

SHA256
5ba08cdcb1339090d812f2c3f2bc7e0a24aff028da928c49b821e11bcf927463

SHA512
9b9743b7c7ddf7801b53fd757171bad6d0bf02ae390b0804c552e51f2786d4054b6d5c58cb6b9730b4e64d434a4824dae4090492335add705a5da0a1795daf09

Download Submit
C:\Users\Public\Desktop\ÌÔ±¦Íø¹º.lnk

Filesize
1010B

MD5
0241624317d179d69afaf8bdd85e6603

SHA1
293e70e2d3ef82aeaafb1edf0f4811290c8e10e6

SHA256
3808e5ceae259f656b45361840daecff6c0e753a2e03cc490d7ce550ffb8b56f

SHA512
806b249b8dc3d6865b96b5a63f1e0b74e2b783a2d58151ceadf5d3b53f66da666300bbde1c8c48a6b26d8c0e98ed60f4b50429b9770b251a34e91082dc2e0aab

Download Submit
memory/3256-73-0x00000000020E0000-0x0000000002151000-memory.dmp

Filesize
452KB

Download
memory/3264-5-0x0000000010000000-0x0000000010003000-memory.dmp

Filesize
12KB

Download
memory/3264-85-0x0000000003750000-0x00000000037C1000-memory.dmp

Filesize
452KB

Download
memory/3264-87-0x0000000010000000-0x0000000010003000-memory.dmp

Filesize
12KB

Download