48928924647039a62310980bd606f339d6efe01c46f58a91c2835b9d19317f85

Analysis

max time kernel
142s
max time network
134s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11-07-2024 11:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

38ea165df9a9102d467b5282c27790c2_JaffaCakes118.exe
Size

1.2MB
MD5

38ea165df9a9102d467b5282c27790c2
SHA1

f8ee4612995a7713467d452e2fce44e218cdeb26
SHA256

48928924647039a62310980bd606f339d6efe01c46f58a91c2835b9d19317f85
SHA512

4ed5c5196f4a42d9b8320a8a6c53adfe351be4493d8c65f400a45949811989e7ef069d7df1b3f937a96023da98ffcd5e39f636039f40f1240d4c8794b932a6c3
SSDEEP

24576:aFsKITnX57bca52voqrXogcAOTabMYn2n4YQmXaq7jk6D:K6nJbXkZXfbMYnHFmqSD

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
992	¸´¼þ Server_Setup.exe
2908	Kauxo.exe

Loads dropped DLL 4 IoCs

pid	Process
1856	38ea165df9a9102d467b5282c27790c2_JaffaCakes118.exe
992	¸´¼þ Server_Setup.exe
992	¸´¼þ Server_Setup.exe
992	¸´¼þ Server_Setup.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\program files\common files\microsoft shared\msinfo\¸´¼þ Server_Setup.jpg	38ea165df9a9102d467b5282c27790c2_JaffaCakes118.exe
File opened for modification	C:\program files\common files\microsoft shared\msinfo\¸´¼þ Server_Setup.exe	¸´¼þ Server_Setup.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Kauxo.exe	¸´¼þ Server_Setup.exe
File opened for modification	C:\Windows\Kauxo.exe	¸´¼þ Server_Setup.exe
File created	C:\Windows\uninstal.bat	¸´¼þ Server_Setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	992	¸´¼þ Server_Setup.exe
Token: SeDebugPrivilege	2908	Kauxo.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2908	Kauxo.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 992	1856	38ea165df9a9102d467b5282c27790c2_JaffaCakes118.exe	30
PID 1856 wrote to memory of 992	1856	38ea165df9a9102d467b5282c27790c2_JaffaCakes118.exe	30
PID 1856 wrote to memory of 992	1856	38ea165df9a9102d467b5282c27790c2_JaffaCakes118.exe	30
PID 1856 wrote to memory of 992	1856	38ea165df9a9102d467b5282c27790c2_JaffaCakes118.exe	30
PID 1856 wrote to memory of 992	1856	38ea165df9a9102d467b5282c27790c2_JaffaCakes118.exe	30
PID 1856 wrote to memory of 992	1856	38ea165df9a9102d467b5282c27790c2_JaffaCakes118.exe	30
PID 1856 wrote to memory of 992	1856	38ea165df9a9102d467b5282c27790c2_JaffaCakes118.exe	30
PID 992 wrote to memory of 1544	992	¸´¼þ Server_Setup.exe	32
PID 992 wrote to memory of 1544	992	¸´¼þ Server_Setup.exe	32
PID 992 wrote to memory of 1544	992	¸´¼þ Server_Setup.exe	32
PID 992 wrote to memory of 1544	992	¸´¼þ Server_Setup.exe	32
PID 992 wrote to memory of 1544	992	¸´¼þ Server_Setup.exe	32
PID 992 wrote to memory of 1544	992	¸´¼þ Server_Setup.exe	32
PID 992 wrote to memory of 1544	992	¸´¼þ Server_Setup.exe	32
PID 2908 wrote to memory of 2636	2908	Kauxo.exe	33
PID 2908 wrote to memory of 2636	2908	Kauxo.exe	33
PID 2908 wrote to memory of 2636	2908	Kauxo.exe	33
PID 2908 wrote to memory of 2636	2908	Kauxo.exe	33

C:\Users\Admin\AppData\Local\Temp\38ea165df9a9102d467b5282c27790c2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\38ea165df9a9102d467b5282c27790c2_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1856
- C:\program files\common files\microsoft shared\msinfo\¸´¼þ Server_Setup.exe
  "C:\program files\common files\microsoft shared\msinfo\¸´¼þ Server_Setup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:992
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Windows\uninstal.bat
    3⤵
    PID:1544

C:\Windows\Kauxo.exe
C:\Windows\Kauxo.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:2636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\uninstal.bat

Filesize
200B

MD5
2f9d0de6ab45675a08475a5494b524f9

SHA1
2bdda895484ef849bfc41ceefcabdb90ded926ed

SHA256
bfcca1ad8e506a717f3edf0f987f7c18f69ae17409d4b0c8c5135be6382f3e96

SHA512
6be57668d2d98c119494f98e54540980d118b2af17927722c7f6e036d0dce6141006b14ab96b38f338e1794ab41dc32783f4a58840f4a402aec44f14ba0c65c4

Download Submit
\Program Files\Common Files\Microsoft Shared\MSInfo\¸´¼þ Server_Setup.exe

Filesize
858KB

MD5
b96478124711da83ccbbd9fb2def36e5

SHA1
9f9eb05c84333d1f0981da08ef56fcd99dcf3433

SHA256
4835132ad1a60370402c35d5fcc8cc700440986659821da062ac6f20e084ce5d

SHA512
762a7d03bd407dba3eefe32566db570f6fd7e4771b16e060bd5a81462fa44458b0a61736a9647f5035da122e4abd05222b13c7c89f08f32b8502f03bd1816a5c

Download Submit
memory/992-65-0x0000000000400000-0x0000000000688000-memory.dmp

Filesize
2.5MB

Download
memory/992-51-0x0000000000400000-0x0000000000688000-memory.dmp

Filesize
2.5MB

Download
memory/992-48-0x0000000000C50000-0x0000000000ED8000-memory.dmp

Filesize
2.5MB

Download
memory/992-49-0x0000000000C50000-0x0000000000ED8000-memory.dmp

Filesize
2.5MB

Download
memory/992-50-0x0000000000C50000-0x0000000000ED8000-memory.dmp

Filesize
2.5MB

Download
memory/992-43-0x0000000000400000-0x0000000000688000-memory.dmp

Filesize
2.5MB

Download
memory/1856-18-0x00000000022E0000-0x00000000022E1000-memory.dmp

Filesize
4KB

Download
memory/1856-13-0x0000000001ED0000-0x0000000001ED1000-memory.dmp

Filesize
4KB

Download
memory/1856-30-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/1856-29-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/1856-28-0x0000000003240000-0x0000000003245000-memory.dmp

Filesize
20KB

Download
memory/1856-27-0x0000000002380000-0x0000000002381000-memory.dmp

Filesize
4KB

Download
memory/1856-26-0x0000000002390000-0x0000000002391000-memory.dmp

Filesize
4KB

Download
memory/1856-25-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/1856-24-0x0000000002330000-0x0000000002331000-memory.dmp

Filesize
4KB

Download
memory/1856-23-0x0000000002350000-0x0000000002351000-memory.dmp

Filesize
4KB

Download
memory/1856-22-0x0000000002370000-0x0000000002371000-memory.dmp

Filesize
4KB

Download
memory/1856-21-0x0000000001EA0000-0x0000000001EA1000-memory.dmp

Filesize
4KB

Download
memory/1856-20-0x0000000002300000-0x0000000002301000-memory.dmp

Filesize
4KB

Download
memory/1856-19-0x0000000001EE0000-0x0000000001EE1000-memory.dmp

Filesize
4KB

Download
memory/1856-9-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/1856-17-0x0000000001D20000-0x0000000001D21000-memory.dmp

Filesize
4KB

Download
memory/1856-16-0x0000000001E90000-0x0000000001E91000-memory.dmp

Filesize
4KB

Download
memory/1856-15-0x00000000022F0000-0x00000000022F1000-memory.dmp

Filesize
4KB

Download
memory/1856-14-0x0000000001EB0000-0x0000000001EB1000-memory.dmp

Filesize
4KB

Download
memory/1856-0-0x0000000000400000-0x0000000000538000-memory.dmp

Filesize
1.2MB

Download
memory/1856-12-0x0000000003250000-0x0000000003251000-memory.dmp

Filesize
4KB

Download
memory/1856-11-0x0000000001D00000-0x0000000001D01000-memory.dmp

Filesize
4KB

Download
memory/1856-10-0x0000000003260000-0x0000000003261000-memory.dmp

Filesize
4KB

Download
memory/1856-34-0x0000000003B40000-0x0000000003B50000-memory.dmp

Filesize
64KB

Download
memory/1856-1-0x0000000001D30000-0x0000000001D84000-memory.dmp

Filesize
336KB

Download
memory/1856-39-0x0000000001D30000-0x0000000001D84000-memory.dmp

Filesize
336KB

Download
memory/1856-41-0x0000000003DC0000-0x0000000004048000-memory.dmp

Filesize
2.5MB

Download
memory/1856-40-0x0000000000400000-0x0000000000538000-memory.dmp

Filesize
1.2MB

Download
memory/1856-2-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/1856-3-0x0000000001CF0000-0x0000000001CF1000-memory.dmp

Filesize
4KB

Download
memory/1856-4-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/1856-5-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/1856-6-0x0000000001CE0000-0x0000000001CE1000-memory.dmp

Filesize
4KB

Download
memory/1856-68-0x0000000003DC0000-0x0000000004048000-memory.dmp

Filesize
2.5MB

Download
memory/1856-7-0x0000000001CD0000-0x0000000001CD1000-memory.dmp

Filesize
4KB

Download
memory/1856-8-0x0000000003260000-0x0000000003261000-memory.dmp

Filesize
4KB

Download
memory/2908-56-0x0000000000400000-0x0000000000688000-memory.dmp

Filesize
2.5MB

Download
memory/2908-67-0x0000000000400000-0x0000000000688000-memory.dmp

Filesize
2.5MB

Download
memory/2908-55-0x0000000000400000-0x0000000000688000-memory.dmp

Filesize
2.5MB

Download