39c3d517eb4ed7bcb66b1ac74f1651a3c5c9c7b603da17c070193a2a2bc53347

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
25/07/2024, 09:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6f11b33a2bfb50efd29a7aacba6947b8_JaffaCakes118.exe
Size

28KB
MD5

6f11b33a2bfb50efd29a7aacba6947b8
SHA1

1e7ba9b955fe5a1d3593089d659fa8caa1e0370c
SHA256

39c3d517eb4ed7bcb66b1ac74f1651a3c5c9c7b603da17c070193a2a2bc53347
SHA512

eaa92515c7b212e92a586d9c48d55ddcec600d328324a1932f6c9f930a3434f5a70454fe3bac8c031dbfa66e9641e6c7025b5e08f0ad256a18f853465d0c8fa1
SSDEEP

384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNNc:Dv8IRRdsxq1DjJcqfp

Score

7^/10

discovery persistence upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4432	services.exe

UPX packed file 28 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4632-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/files/0x00080000000234b1-4.dat	upx
behavioral2/memory/4432-7-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4632-13-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/4432-14-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4432-19-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4432-24-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4432-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4432-31-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4632-35-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/4432-36-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4632-37-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/4432-38-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x000b0000000234c7-48.dat	upx
behavioral2/memory/4632-181-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/4432-182-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4632-276-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/4432-277-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4632-290-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/4432-291-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4432-296-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4632-295-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/4632-390-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/4432-391-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4632-403-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/4432-404-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4632-408-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/4432-409-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	6f11b33a2bfb50efd29a7aacba6947b8_JaffaCakes118.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	6f11b33a2bfb50efd29a7aacba6947b8_JaffaCakes118.exe
File opened for modification	C:\Windows\java.exe	6f11b33a2bfb50efd29a7aacba6947b8_JaffaCakes118.exe
File created	C:\Windows\java.exe	6f11b33a2bfb50efd29a7aacba6947b8_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6f11b33a2bfb50efd29a7aacba6947b8_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4632 wrote to memory of 4432	4632	6f11b33a2bfb50efd29a7aacba6947b8_JaffaCakes118.exe	84
PID 4632 wrote to memory of 4432	4632	6f11b33a2bfb50efd29a7aacba6947b8_JaffaCakes118.exe	84
PID 4632 wrote to memory of 4432	4632	6f11b33a2bfb50efd29a7aacba6947b8_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\6f11b33a2bfb50efd29a7aacba6947b8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6f11b33a2bfb50efd29a7aacba6947b8_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4632
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:4432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\3WWFCFW4\results[2].htm

Filesize
1KB

MD5
211da0345fa466aa8dbde830c83c19f8

SHA1
779ece4d54a099274b2814a9780000ba49af1b81

SHA256
aec2ac9539d1b0cac493bbf90948eca455c6803342cc83d0a107055c1d131fd5

SHA512
37fd7ef6e11a1866e844439318ae813059106fbd52c24f580781d90da3f64829cf9654acac0dd0f2098081256c5dcdf35c70b2cbef6cbe3f0b91bd2d8edd22ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\3WWFCFW4\searchZTL2R54N.htm

Filesize
116KB

MD5
b6f4e80b4ab6d734f85e6a5d68c81754

SHA1
e5e4b52ae29d82a9ee9471af2d279b10946b45b2

SHA256
3ab0995d08b0f7ddc089fe278890b1d6a976b02479600a0e8a981477043c7db6

SHA512
754d073a86116f3e15fbb5c8c125c81f4b94437387896e79b3d339ba184b674da155d07c3ffdd27773d8bf98b61f4f9ff5e6cc8cfbc39a16fb5e9b5ce42aad2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LO59P0R8\QZ7AF2Z8.htm

Filesize
175KB

MD5
65e22b5d40a48bd79f64c6710dc2a800

SHA1
85ca7a382b906836b110ab618a754903fb4b1975

SHA256
61e1e571b6b63b43f6e8cf76c11c1b7f1d2ed5542624f90eaa637c4f305f3197

SHA512
fbe8b1ca2f90ac831afde50c3a5810656a3dbf37ab15821efc5fffdc085ceb514f5aefc78c73a8418069c77795c7e14e72bc1e6a0085e11f819ef1f5958e9418

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LO59P0R8\search[2].htm

Filesize
144KB

MD5
d5fae74240cd0c422807ce6dda0cd7f4

SHA1
0f25013a875406504242fc41b11bf0febcab43c9

SHA256
f8e770b7f8f9cf092abec537f8d13a2ebcff7169cf502f3e17d16cb704cd158f

SHA512
e0fdcd4fb2fa8273ae80aaba52ca7d51fc5175395a8f4bc0946fdeab2d5b8313c131a655988a7791f6a3a24fa4076b7f57b3f22771da9a1d3608ccbb25ceba99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\T1DWO314\results[4].htm

Filesize
1KB

MD5
ee4aed56584bf64c08683064e422b722

SHA1
45e5ba33f57c6848e84b66e7e856a6b60af6c4a8

SHA256
a4e6ba8c1fe3df423e6f17fcbeeaa7e90e2bd2fffe8f98ff4b3e6ed970e32c61

SHA512
058f023cb934a00c8f1c689001438c9bdd067d923ddcbe7a951f54d3ca82218803e0e81fbc9af5c56375ff7961deed0359af1ffa7335d41379ee97d01a76ded6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\T1DWO314\search[2].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\T1DWO314\search[4].htm

Filesize
151KB

MD5
ddbf6edb3dd723def6cfb69b5f4a778f

SHA1
85f4a3a42cfae98ddaa039e8421b12f554aa8de8

SHA256
cf284c85a9439b1afb8e1434bff919061c2016c8e940b03de791213d0e1da49c

SHA512
986247a77f008c2a42a0c915bb0b60bf0ca6410af484a0a9119a3557946aac14c3185d63f28b07d522f55a3adf8579876fc05dcca68ca824b821ca308dce7804

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YFAWXPEZ\7E2Q58AH.htm

Filesize
175KB

MD5
40d92fd981630af76cd414a40e2f1222

SHA1
f36906006e8a872cc5c40a1b004c2d147d729ecf

SHA256
fc6799667d66189f0fcd28fdba004728a096cc8ee37c94771d7d8daf29ab1af3

SHA512
bb201dd95688c0ba9b502addc09580015833769eff77b78cc8648a07187627d445786eb03b81b50a0d1cafcc3ed878f279f277e1ded9c260209fd62dd2bb567b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YFAWXPEZ\search[5].htm

Filesize
130KB

MD5
5c95e54bc62ea8f418e2994b261b77ac

SHA1
c2a0f2fc1ec9b268ad7b30bd964774910af2d728

SHA256
9bb04d073d3ab5f52824de5518a56d6cabba34f2dae3aa69b265b9050c8b2b43

SHA512
a8cf2955962a99da9bb848b88908c776ca303c0ad8b964c04f5720db0c50a75d981ee4f99e5a0873345b085beb2a013b83c695618e0444db2a222e68bcf4f3b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YFAWXPEZ\search[7].htm

Filesize
118KB

MD5
9e80237064df57433f27152cf03d46db

SHA1
01f6011e7501514789ca28a23228228372e59ec4

SHA256
f9068af21972eda6de155c4764e8298b5a71d7663d4bf5fa942dd8b76d28b8d2

SHA512
8dff019cc07396e3fc571d241fa300d2591e21edf3c794b80c06cd7850e63df6848e105c30204c468bab776ece9eb8ae880fbbbddd6fc9cc72b28ceaf3d9b0df

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpB766.tmp

Filesize
28KB

MD5
cb3782ff04b2324513b268af0c28e8ce

SHA1
b886fff62af6ab9caeacb44e348dba04fdafe7c9

SHA256
89213aefe2bc23639a01d85cbc2bc93779a4ea5797c35d02e640300e263c940e

SHA512
fb9dfe235fac3fe18196f3f07e015aac51afa080c2ca18ca48a74ace45663d07aa3e98496c3a8a05a4bcb01752fc30f40fe60227ec355950497ded4879d2950d

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
6a0b595c2873737b7669df2167908cd9

SHA1
20c4fd617c63f2624dcfb0816b5630adcb0043ed

SHA256
7db68f974cb65a2a5dd0e2d656d0484a308feaa5183363af388746cc8b0a68ae

SHA512
9056515fcf3ed49aea01f3476d134c706b92bf43ec691ea21ff6b819cd112a1309702d8e4ab6860dd5c6d2cd6b96bfd4799b505ee563c8fd824932c9b6abf78e

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
245e849d1ebbbb1c5bb1cb1a5e22defd

SHA1
185872fefc95b345453e8530423dbe9fb7381074

SHA256
4f7b9937a08e052ee3a91f52f5a2fa5a3b6ee934471fda9e8ae091b824dbb61e

SHA512
86e23dd2de1638c2ed496912621923896c568fad133df171bdc1f26f732a5db77cb8a81257fdcb50695370eb240d0e5efaafe66d75767ad398597ab7641d5a95

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
cc3aa48fb310d2694e854f5bdb54d033

SHA1
35ba6d31bf8f986728154f355749dfa4e63de33d

SHA256
b2201b5a10c2fc61dfd2de582ddba5b490751c6be42a504c059507de63b22505

SHA512
bb879153023cfcc3739c0bbe6422743119e170f4b27df0da90703e4ace6a920e7443594171a7a63dcd068bd7c9148a7a76ce46d99788bac6d71d32dbda9ac625

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/4432-296-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4432-291-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4432-409-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4432-36-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4432-404-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4432-391-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4432-182-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4432-31-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4432-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4432-24-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4432-7-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4432-277-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4432-14-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4432-38-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4432-19-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4632-295-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/4632-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/4632-290-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/4632-13-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/4632-276-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/4632-390-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/4632-181-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/4632-403-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/4632-35-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/4632-408-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/4632-37-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads