a15545627b2c59118d6e8566abb9e9473039ae0e57f807d6ccaf706a7f027ec6

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 15:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3df5a3ded590ad9cf040125ec84dac43_JaffaCakes118.exe
Size

76KB
MD5

3df5a3ded590ad9cf040125ec84dac43
SHA1

6a9caf283a5c0109018333250ab6d937a3012ac9
SHA256

a15545627b2c59118d6e8566abb9e9473039ae0e57f807d6ccaf706a7f027ec6
SHA512

23ca27afa7ac34db6dae69c6ed617b9ac62f84148fec45548673cc52427c1f585bbb1b2d2cb9fd80c6d36f98cfa99893bac2fb30a57b08267decfa5ce6db83b3
SSDEEP

768:jHzDcSmR25QinzxPCAex+L20h01k2BlKvzdP928E/h2I1CdwxpiN:TzD/puinNPCrgJWMeQh

Score

10^/10

evasion execution

Malware Config

Signatures

Disables service(s) 3 TTPs
evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
1624	lsas.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ip.ini	lsas.exe
File created	C:\Windows\SysWOW64\ip2.ini	lsas.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\lsas.exe	3df5a3ded590ad9cf040125ec84dac43_JaffaCakes118.exe
File opened for modification	C:\WINDOWS\lsas.exe	3df5a3ded590ad9cf040125ec84dac43_JaffaCakes118.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3008	sc.exe
776	sc.exe
3740	sc.exe
2768	sc.exe
2096	sc.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 54 IoCs

pid	Process
1624	lsas.exe
1624	lsas.exe
1624	lsas.exe
1624	lsas.exe
1624	lsas.exe
1624	lsas.exe
1624	lsas.exe
1624	lsas.exe
1624	lsas.exe
1624	lsas.exe
1624	lsas.exe
1624	lsas.exe
1624	lsas.exe
1624	lsas.exe
1624	lsas.exe
1624	lsas.exe
1624	lsas.exe
1624	lsas.exe
1624	lsas.exe
1624	lsas.exe
1624	lsas.exe
1624	lsas.exe
1624	lsas.exe
1624	lsas.exe
1624	lsas.exe
1624	lsas.exe
1624	lsas.exe
1624	lsas.exe
1624	lsas.exe
1624	lsas.exe
1624	lsas.exe
1624	lsas.exe
1624	lsas.exe
1624	lsas.exe
1624	lsas.exe
1624	lsas.exe
1624	lsas.exe
1624	lsas.exe
1624	lsas.exe
1624	lsas.exe
1624	lsas.exe
1624	lsas.exe
1624	lsas.exe
1624	lsas.exe
1624	lsas.exe
1624	lsas.exe
1624	lsas.exe
1624	lsas.exe
1624	lsas.exe
1624	lsas.exe
1624	lsas.exe
1624	lsas.exe
1624	lsas.exe
1624	lsas.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4188	3df5a3ded590ad9cf040125ec84dac43_JaffaCakes118.exe
1624	lsas.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4188 wrote to memory of 3984	4188	3df5a3ded590ad9cf040125ec84dac43_JaffaCakes118.exe	85
PID 4188 wrote to memory of 3984	4188	3df5a3ded590ad9cf040125ec84dac43_JaffaCakes118.exe	85
PID 4188 wrote to memory of 3984	4188	3df5a3ded590ad9cf040125ec84dac43_JaffaCakes118.exe	85
PID 4188 wrote to memory of 1624	4188	3df5a3ded590ad9cf040125ec84dac43_JaffaCakes118.exe	87
PID 4188 wrote to memory of 1624	4188	3df5a3ded590ad9cf040125ec84dac43_JaffaCakes118.exe	87
PID 4188 wrote to memory of 1624	4188	3df5a3ded590ad9cf040125ec84dac43_JaffaCakes118.exe	87
PID 3984 wrote to memory of 3008	3984	cmd.exe	88
PID 3984 wrote to memory of 3008	3984	cmd.exe	88
PID 3984 wrote to memory of 3008	3984	cmd.exe	88
PID 3984 wrote to memory of 1700	3984	cmd.exe	89
PID 3984 wrote to memory of 1700	3984	cmd.exe	89
PID 3984 wrote to memory of 1700	3984	cmd.exe	89
PID 1700 wrote to memory of 4392	1700	net.exe	90
PID 1700 wrote to memory of 4392	1700	net.exe	90
PID 1700 wrote to memory of 4392	1700	net.exe	90
PID 3984 wrote to memory of 776	3984	cmd.exe	92
PID 3984 wrote to memory of 776	3984	cmd.exe	92
PID 3984 wrote to memory of 776	3984	cmd.exe	92
PID 3984 wrote to memory of 2568	3984	cmd.exe	93
PID 3984 wrote to memory of 2568	3984	cmd.exe	93
PID 3984 wrote to memory of 2568	3984	cmd.exe	93
PID 2568 wrote to memory of 1352	2568	net.exe	94
PID 2568 wrote to memory of 1352	2568	net.exe	94
PID 2568 wrote to memory of 1352	2568	net.exe	94
PID 3984 wrote to memory of 3740	3984	cmd.exe	95
PID 3984 wrote to memory of 3740	3984	cmd.exe	95
PID 3984 wrote to memory of 3740	3984	cmd.exe	95
PID 3984 wrote to memory of 2104	3984	cmd.exe	96
PID 3984 wrote to memory of 2104	3984	cmd.exe	96
PID 3984 wrote to memory of 2104	3984	cmd.exe	96
PID 2104 wrote to memory of 4788	2104	net.exe	97
PID 2104 wrote to memory of 4788	2104	net.exe	97
PID 2104 wrote to memory of 4788	2104	net.exe	97
PID 3984 wrote to memory of 2768	3984	cmd.exe	98
PID 3984 wrote to memory of 2768	3984	cmd.exe	98
PID 3984 wrote to memory of 2768	3984	cmd.exe	98
PID 3984 wrote to memory of 5080	3984	cmd.exe	99
PID 3984 wrote to memory of 5080	3984	cmd.exe	99
PID 3984 wrote to memory of 5080	3984	cmd.exe	99
PID 5080 wrote to memory of 4504	5080	net.exe	100
PID 5080 wrote to memory of 4504	5080	net.exe	100
PID 5080 wrote to memory of 4504	5080	net.exe	100
PID 3984 wrote to memory of 2096	3984	cmd.exe	101
PID 3984 wrote to memory of 2096	3984	cmd.exe	101
PID 3984 wrote to memory of 2096	3984	cmd.exe	101
PID 3984 wrote to memory of 2720	3984	cmd.exe	102
PID 3984 wrote to memory of 2720	3984	cmd.exe	102
PID 3984 wrote to memory of 2720	3984	cmd.exe	102
PID 2720 wrote to memory of 1136	2720	net.exe	103
PID 2720 wrote to memory of 1136	2720	net.exe	103
PID 2720 wrote to memory of 1136	2720	net.exe	103
PID 1624 wrote to memory of 4888	1624	lsas.exe	105
PID 1624 wrote to memory of 4888	1624	lsas.exe	105
PID 1624 wrote to memory of 4888	1624	lsas.exe	105
PID 1624 wrote to memory of 220	1624	lsas.exe	106
PID 1624 wrote to memory of 220	1624	lsas.exe	106
PID 1624 wrote to memory of 220	1624	lsas.exe	106
PID 1624 wrote to memory of 2476	1624	lsas.exe	107
PID 1624 wrote to memory of 2476	1624	lsas.exe	107
PID 1624 wrote to memory of 2476	1624	lsas.exe	107
PID 1624 wrote to memory of 884	1624	lsas.exe	108
PID 1624 wrote to memory of 884	1624	lsas.exe	108
PID 1624 wrote to memory of 884	1624	lsas.exe	108
PID 1624 wrote to memory of 520	1624	lsas.exe	109

C:\Users\Admin\AppData\Local\Temp\3df5a3ded590ad9cf040125ec84dac43_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3df5a3ded590ad9cf040125ec84dac43_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4188
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\ip.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3984
- - C:\Windows\SysWOW64\sc.exe
    sc.exe config rfwservice start= disabled
    3⤵
    - Launches sc.exe
    PID:3008
- - C:\Windows\SysWOW64\net.exe
    net stop rfwservice
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1700
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop rfwservice
      4⤵
      PID:4392
- - C:\Windows\SysWOW64\sc.exe
    sc.exe config rsccenter start= disabled
    3⤵
    - Launches sc.exe
    PID:776
- - C:\Windows\SysWOW64\net.exe
    net stop rsccenter
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2568
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop rsccenter
      4⤵
      PID:1352
- - C:\Windows\SysWOW64\sc.exe
    sc.exe config rfwproxysrv start= disabled
    3⤵
    - Launches sc.exe
    PID:3740
- - C:\Windows\SysWOW64\net.exe
    net stop rfwproxysrv
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2104
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop rfwproxysrv
      4⤵
      PID:4788
- - C:\Windows\SysWOW64\sc.exe
    sc.exe config kpfwsvc start= disabled
    3⤵
    - Launches sc.exe
    PID:2768
- - C:\Windows\SysWOW64\net.exe
    net stop kpfwsvc
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5080
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop kpfwsvc
      4⤵
      PID:4504
- - C:\Windows\SysWOW64\sc.exe
    sc.exe config kissvc start= disabled
    3⤵
    - Launches sc.exe
    PID:2096
- - C:\Windows\SysWOW64\net.exe
    net stop kissvc
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2720
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop kissvc
      4⤵
      PID:1136
- C:\WINDOWS\lsas.exe
  C:\WINDOWS\lsas.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1624
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32 /s "C:\WINDOWS\Msinet.ocx"
    3⤵
    PID:4888
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32 /s "C:\WINDOWS\Msinet.ocx"
    3⤵
    PID:220
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32 /s "C:\WINDOWS\Msinet.ocx"
    3⤵
    PID:2476
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32 /s "C:\WINDOWS\Msinet.ocx"
    3⤵
    PID:884
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32 /s "C:\WINDOWS\Msinet.ocx"
    3⤵
    PID:520
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32 /s "C:\WINDOWS\Msinet.ocx"
    3⤵
    PID:4108
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32 /s "C:\WINDOWS\Msinet.ocx"
    3⤵
    PID:4356
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32 /s "C:\WINDOWS\Msinet.ocx"
    3⤵
    PID:3320
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32 /s "C:\WINDOWS\Msinet.ocx"
    3⤵
    PID:556
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32 /s "C:\WINDOWS\Msinet.ocx"
    3⤵
    PID:3524
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32 /s "C:\WINDOWS\Msinet.ocx"
    3⤵
    PID:4520
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32 /s "C:\WINDOWS\Msinet.ocx"
    3⤵
    PID:232
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32 /s "C:\WINDOWS\Msinet.ocx"
    3⤵
    PID:3048
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32 /s "C:\WINDOWS\Msinet.ocx"
    3⤵
    PID:4500
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32 /s "C:\WINDOWS\Msinet.ocx"
    3⤵
    PID:1008
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32 /s "C:\WINDOWS\Msinet.ocx"
    3⤵
    PID:3532
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32 /s "C:\WINDOWS\Msinet.ocx"
    3⤵
    PID:3516
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32 /s "C:\WINDOWS\Msinet.ocx"
    3⤵
    PID:1352
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32 /s "C:\WINDOWS\Msinet.ocx"
    3⤵
    PID:4788
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32 /s "C:\WINDOWS\Msinet.ocx"
    3⤵
    PID:1572
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32 /s "C:\WINDOWS\Msinet.ocx"
    3⤵
    PID:3464
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32 /s "C:\WINDOWS\Msinet.ocx"
    3⤵
    PID:3416
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32 /s "C:\WINDOWS\Msinet.ocx"
    3⤵
    PID:4644
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32 /s "C:\WINDOWS\Msinet.ocx"
    3⤵
    PID:4580
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32 /s "C:\WINDOWS\Msinet.ocx"
    3⤵
    PID:4000
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32 /s "C:\WINDOWS\Msinet.ocx"
    3⤵
    PID:2452
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32 /s "C:\WINDOWS\Msinet.ocx"
    3⤵
    PID:1596
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32 /s "C:\WINDOWS\Msinet.ocx"
    3⤵
    PID:520
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32 /s "C:\WINDOWS\Msinet.ocx"
    3⤵
    PID:2764
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32 /s "C:\WINDOWS\Msinet.ocx"
    3⤵
    PID:4104
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32 /s "C:\WINDOWS\Msinet.ocx"
    3⤵
    PID:4380
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32 /s "C:\WINDOWS\Msinet.ocx"
    3⤵
    PID:760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\1.htm

Filesize
393KB

MD5
b0668eccfa826a9d5dbee2fe1a066346

SHA1
dead93641c680d92779a5534640e26b3cb476e3d

SHA256
d4cfbf21c45addbb3d45f4dc0a11798b6a0fd03d196891617c2583df6853821d

SHA512
ad7606c15273533382121a5f285e0826d0721c1ad2383df3934f080628800a253240a6f4ad4e15bef70082a1140f072c293d2a6747f36dac15992b24f183d924

Download Submit
C:\Windows\lsas.exe

Filesize
76KB

MD5
3df5a3ded590ad9cf040125ec84dac43

SHA1
6a9caf283a5c0109018333250ab6d937a3012ac9

SHA256
a15545627b2c59118d6e8566abb9e9473039ae0e57f807d6ccaf706a7f027ec6

SHA512
23ca27afa7ac34db6dae69c6ed617b9ac62f84148fec45548673cc52427c1f585bbb1b2d2cb9fd80c6d36f98cfa99893bac2fb30a57b08267decfa5ce6db83b3

Download Submit
\??\c:\ip.bat

Filesize
309B

MD5
96e5ad84ee4fc99164853f0618c2b0c2

SHA1
d2ddc324d3276d882a0a00bdbd24dc49b0c8deac

SHA256
890e41788ac2a14fd27a75c0a0718f9cb3e3bbe2fae1f7b5730308fd695a9984

SHA512
abc60dab5615a89648e736a9cb0a3cc9b4d2f1ef5d8e6b5a412ec8b0492bfb38ad535ebd11ad06dfd402f56ac6468db8012edb09e404dce1a3b4da7f66ab765a

Download Submit