Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    23/07/2024, 16:39

General

  • Target

    685d347a2901d1d069ec61491e6b7db0_JaffaCakes118.exe

  • Size

    58KB

  • MD5

    685d347a2901d1d069ec61491e6b7db0

  • SHA1

    b1dd243ffeb88d4dcc340906062507eb3a4815c3

  • SHA256

    55b371e81cfc2a7f336c5d7ad36a08e9cd0fac36945a3e91d8bd4949f5d747bd

  • SHA512

    5c05bc6a47d0e149f0b921a06af35effcbe4df6e5fc56d4bb7a2a312220f0b5f72b9a413769fbbd671fdc5a1b1510c6a9d07faba627fbcac5c05f2f1cea00412

  • SSDEEP

    768:0dICxZk/89MpVT7woQJcW/bnqC03T/yEwSndA/zJmnPi3Jnv:0TYd5QJc/vaSybs4

Malware Config

Signatures

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Service Discovery 1 TTPs 1 IoCs

    Attempt to gather information on host's network.

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Permission Groups Discovery: Local Groups 1 TTPs

    Attempt to find local system groups and permission settings.

  • System Location Discovery: System Language Discovery 1 TTPs 53 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • System Network Connections Discovery 1 TTPs 1 IoCs

    Attempt to get a listing of network connections.

  • Discovers systems in the same network 1 TTPs 4 IoCs
  • Gathers network information 2 TTPs 3 IoCs

    Uses commandline utility to view network configuration.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Runs net.exe
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 32 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\685d347a2901d1d069ec61491e6b7db0_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\685d347a2901d1d069ec61491e6b7db0_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2708
    • C:\ProgramData\Application Data\wmimgmt.exe
      "C:\ProgramData\Application Data\wmimgmt.exe"
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2352
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /v:on /c C:\Users\Admin\AppData\Local\Temp\ghi.bat
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2760
        • C:\Windows\SysWOW64\findstr.exe
          findstr /s "YM.CGP_" "C:\Users\Admin"\..\*.txt
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2252
        • C:\Windows\SysWOW64\chcp.com
          chcp
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2744
        • C:\Windows\SysWOW64\net.exe
          net user
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2752
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 user
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2620
        • C:\Windows\SysWOW64\net.exe
          net localgroup administrators
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2572
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 localgroup administrators
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2568
        • C:\Windows\SysWOW64\tasklist.exe
          tasklist
          4⤵
          • Enumerates processes with tasklist
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2624
        • C:\Windows\SysWOW64\systeminfo.exe
          systeminfo
          4⤵
          • System Location Discovery: System Language Discovery
          • Gathers system information
          PID:1620
        • C:\Windows\SysWOW64\reg.exe
          reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2960
        • C:\Windows\SysWOW64\find.exe
          find "REG_"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1972
        • C:\Windows\SysWOW64\reg.exe
          reg query HKEY_CURRENT_USER\Software\Microsoft\Office
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1180
        • C:\Windows\SysWOW64\reg.exe
          reg query HKEY_CURRENT_USER\Software\Microsoft\Office\8.0\Common\UserInfo
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2904
        • C:\Windows\SysWOW64\reg.exe
          reg query HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Common\UserInfo
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2268
        • C:\Windows\SysWOW64\reg.exe
          reg query HKEY_CURRENT_USER\Software\Microsoft\Office\10.0\Common\UserInfo
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2280
        • C:\Windows\SysWOW64\reg.exe
          reg query HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Common\UserInfo
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1688
        • C:\Windows\SysWOW64\reg.exe
          reg query HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\UserInfo
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1036
        • C:\Windows\SysWOW64\reg.exe
          reg query HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Common\UserInfo
          4⤵
          • System Location Discovery: System Language Discovery
          PID:396
        • C:\Windows\SysWOW64\ipconfig.exe
          ipconfig /all
          4⤵
          • System Location Discovery: System Language Discovery
          • Gathers network information
          PID:2092
        • C:\Windows\SysWOW64\NETSTAT.EXE
          netstat -ano
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Connections Discovery
          • Gathers network information
          • Suspicious use of AdjustPrivilegeToken
          PID:2028
        • C:\Windows\SysWOW64\ARP.EXE
          arp -a
          4⤵
          • Network Service Discovery
          • System Location Discovery: System Language Discovery
          PID:1000
        • C:\Windows\SysWOW64\NETSTAT.EXE
          netstat -r
          4⤵
          • System Location Discovery: System Language Discovery
          • Gathers network information
          PID:1232
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print
            5⤵
            • System Location Discovery: System Language Discovery
            PID:892
            • C:\Windows\SysWOW64\ROUTE.EXE
              C:\Windows\system32\route.exe print
              6⤵
              • System Location Discovery: System Language Discovery
              PID:2892
        • C:\Windows\SysWOW64\net.exe
          net start
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2836
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 start
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2920
        • C:\Windows\SysWOW64\net.exe
          net use
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2276
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" echo n"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2160
        • C:\Windows\SysWOW64\net.exe
          net share
          4⤵
          • System Location Discovery: System Language Discovery
          PID:448
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 share
            5⤵
            • System Location Discovery: System Language Discovery
            PID:1080
        • C:\Windows\SysWOW64\net.exe
          net view /domain
          4⤵
          • System Location Discovery: System Language Discovery
          • Discovers systems in the same network
          PID:576
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\s.log "
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1320
        • C:\Windows\SysWOW64\find.exe
          find /i /v "------"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1364
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\t.log "
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2184
        • C:\Windows\SysWOW64\find.exe
          find /i /v "domain"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:712
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\s.log "
          4⤵
          • System Location Discovery: System Language Discovery
          PID:536
        • C:\Windows\SysWOW64\find.exe
          find /i /v "¬A╛╣"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:604
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\t.log "
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1152
        • C:\Windows\SysWOW64\find.exe
          find /i /v "░⌡ªµª¿"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2368
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\s.log "
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2372
        • C:\Windows\SysWOW64\find.exe
          find /i /v "├ⁿ┴ε"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2532
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\t.log "
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2364
        • C:\Windows\SysWOW64\find.exe
          find /i /v "completed successfully"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2128
        • C:\Windows\SysWOW64\net.exe
          net view /domain:"WORKGROUP"
          4⤵
          • System Location Discovery: System Language Discovery
          • Discovers systems in the same network
          PID:2400
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\workgrp.tmp "
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2024
        • C:\Windows\SysWOW64\find.exe
          find "\\"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2240
        • C:\Windows\SysWOW64\net.exe
          net view \\WHMFPZKA
          4⤵
          • System Location Discovery: System Language Discovery
          • Discovers systems in the same network
          PID:2304
        • C:\Windows\SysWOW64\net.exe
          net view \\WHMFPZKA
          4⤵
          • System Location Discovery: System Language Discovery
          • Discovers systems in the same network
          PID:2396
        • C:\Windows\SysWOW64\find.exe
          find "Disk"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1804
        • C:\Windows\SysWOW64\PING.EXE
          ping -n 1 WHMFPZKA
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:280
        • C:\Windows\SysWOW64\findstr.exe
          findstr /i "Pinging Reply Request Unknown"
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          PID:1324

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\INFO.TXT

          Filesize

          43B

          MD5

          f5d66157ce5873de3959fa1160ecede8

          SHA1

          3b33b3feaa3cb6af7035470e251b5dd88e09f6ee

          SHA256

          b5dddf3d6bd47f47bd33eba71fd13bedc5ed9ed75a29dcd1d2391b9fb0705109

          SHA512

          26bc1eaf5c92afbc5cb6380638e3e0d34b760984b609dd7f99933ee43c0eb034e0e9d03c9a142c81f4a98d65c9a91d66430bd3456bdd2308d43f952da92cdd46

        • C:\Users\Admin\AppData\Local\Temp\INFO.TXT

          Filesize

          7KB

          MD5

          9f0f9c2cd3516782078ae7d01722e820

          SHA1

          362bdc807a91d6a71eb716f88d414c13de30f641

          SHA256

          4ed136d16fcfdd4636ed965106ec016627ec82c8b086cb469b7458d673da4e06

          SHA512

          e0b3f03a0e0291f7ebedee45ffb6e40782f81db165458e34702fab0e2e0e5694f140506aee4c5695125d564c49eee27b2b5cd15a3ceed5b2e38b8a870767c547

        • C:\Users\Admin\AppData\Local\Temp\INFO.TXT

          Filesize

          15KB

          MD5

          67d1cccf9e24d0bd915166027165a76c

          SHA1

          a44be78105072d8bc5a814f271199377e12d7287

          SHA256

          6474a71cb4448b2f7cc49f6e5a939ade0e98a40eb1c03631a5b57c8f01c791d7

          SHA512

          67d4f4f822acb8e68d6b92c46f1120360a217c5df91755f40be1f327c7981184fe3ae9193a5ffeab900c8893b64e878e78c71355e705274715e93ecdc45d4de5

        • C:\Users\Admin\AppData\Local\Temp\INFO.TXT

          Filesize

          24.9MB

          MD5

          671d99a2c38d101f9592ecbdda17451d

          SHA1

          711e794a1df5f65b9d58ba57389cb151316f2721

          SHA256

          c7e16a9b31756bb4a5346c7388106d69c9915190f72f29b19d3fbd5133edef50

          SHA512

          d22ef9301445fbee98b36ec174f784e54afb4500d8d07a732fc6fedf9d54b6aee41af167ff2868acbf6234643065b2483527b80456f3c80f257edef331955798

        • C:\Users\Admin\AppData\Local\Temp\drivers.p

          Filesize

          15B

          MD5

          4ff8e80638f36abd8fb131c19425317b

          SHA1

          358665afaf5f88dfebcdb7c56e963693c520c136

          SHA256

          6b8ceb900443f4924efd3187693038965ad7edb488879305489aa72d78f69626

          SHA512

          d4e6e3d789bc76102c500b46a5aa799c5ebfc432a44117aa0b7c7512439d33a423630b963fb04cda1da17a7f6517b276a3e9298c17cbf795964090f4b9e5d8f1

        • C:\Users\Admin\AppData\Local\Temp\ghi.bat

          Filesize

          3KB

          MD5

          b98e8fcde49a1caee295a6bd3d264e56

          SHA1

          71c82391a8617212ad48c8d79755e71be2e20be9

          SHA256

          e369c7e2e7ac0280882693038b213be0309c910df62f35a5159a125ecd18fb9a

          SHA512

          fb5fa414449e7dd4ce1fedcb92487f59ed18d7fbd3146eb59ec8f7256d68551adebb7d35e859fe7b6bce5a0b042b0de1e9ee56369a8686976dd121b44ff46742

        • C:\Users\Admin\AppData\Local\Temp\s.log

          Filesize

          153B

          MD5

          b256c8a481b065860c2812e742f50250

          SHA1

          51ddf02764fb12d88822450e8a27f9deac85fe54

          SHA256

          b167a692a2ff54cc5625797ddc367ba8736797130b93961d68b9150aef2f0e12

          SHA512

          f425ae70449d16bdb05fcc7913744fb0a81ab81278735d77ce316007b8298ad3c3991a29af67b336420f7dca94702271e59186174b5b78b5cdab1f8ce0163360

        • C:\Users\Admin\AppData\Local\Temp\s.log

          Filesize

          64B

          MD5

          e29f80bf6f6a756e0bc6d7f5189a9bb2

          SHA1

          acdd1032b7dc189f8e68b390fe6fd964618acd72

          SHA256

          8bfe9f81e5c82cbfe69203c993009c22f940f20727fa8cb43773958bf0eba7c7

          SHA512

          f390fc82bdeb43721aa08f3666a4ed7d9ad4a5c1ff91be6967336417a5a5b7968b945773f68effcbe961072b801c3681455cf98b956cd802eba24190bd54268e

        • C:\Users\Admin\AppData\Local\Temp\t.log

          Filesize

          72B

          MD5

          59f2768506355d8bc50979f6d64ded26

          SHA1

          b2d315b3857bec8335c526a08d08d6a1b5f5c151

          SHA256

          7f9f3cbab32b3a5022bed245092835cb12502fa2e79d85c8c45d478918ee6569

          SHA512

          e9aa231d19cb5f93711cd3ffee4a6bd8764b21249ed7eb06ff34bcb457cd075384a0858ea35a99280bff16c01875a4ed79598a6503fcf5262da6f0849b5b1028

        • C:\Users\Admin\AppData\Local\Temp\workgrp.tmp

          Filesize

          234B

          MD5

          491d6bf1ec097bcdb4251d771380c889

          SHA1

          9a8be90aa9ae62dae99aa869414af0b504b20677

          SHA256

          e3ef343510b639577abcd0c8d1a8a9070330f1a61041f6c0f5f1638c5cb4b7c7

          SHA512

          b68726466fa541b64361e8d98cc653aac7a9547250a33d8f4a59d03a0725fdaeb950907bfcdc8c21ace621427cbca8f56a9d307e9d272dedcb1f4775e1ca99bd

        • \ProgramData\wmimgmt.exe

          Filesize

          58KB

          MD5

          685d347a2901d1d069ec61491e6b7db0

          SHA1

          b1dd243ffeb88d4dcc340906062507eb3a4815c3

          SHA256

          55b371e81cfc2a7f336c5d7ad36a08e9cd0fac36945a3e91d8bd4949f5d747bd

          SHA512

          5c05bc6a47d0e149f0b921a06af35effcbe4df6e5fc56d4bb7a2a312220f0b5f72b9a413769fbbd671fdc5a1b1510c6a9d07faba627fbcac5c05f2f1cea00412

        • memory/2352-72-0x0000000000400000-0x000000000042B000-memory.dmp

          Filesize

          172KB

        • memory/2708-9-0x0000000000280000-0x00000000002AB000-memory.dmp

          Filesize

          172KB

        • memory/2708-11-0x0000000000400000-0x000000000042B000-memory.dmp

          Filesize

          172KB

        • memory/2708-0-0x0000000000400000-0x000000000042B000-memory.dmp

          Filesize

          172KB

        • memory/2708-10-0x0000000000280000-0x00000000002AB000-memory.dmp

          Filesize

          172KB