3f4f2cf6a2844efece2286897dd5e8feda908b6377f8d6bb25bd8fac84e13e00

Analysis

max time kernel
149s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
25/07/2024, 17:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

708abe50048782def5929bc281362498_JaffaCakes118.exe
Size

77KB
MD5

708abe50048782def5929bc281362498
SHA1

a4bd6a219d317efe3274d84a3f5ea40b84b4ace1
SHA256

3f4f2cf6a2844efece2286897dd5e8feda908b6377f8d6bb25bd8fac84e13e00
SHA512

4e13c6ddfb213486efac01e1c14a1ece20eda2552c0af02a81ce452231d0089bab5c086509593e70c49cbd69d95fe82d8aadce5f8c6817fd8c48c940ad9d427c
SSDEEP

1536:8ujlHwdwzY9FPcVH5P4Zq/Dnr47HrHaL:txm+H5PR/DU7eL

Score

8^/10

discovery evasion execution persistence

Malware Config

Signatures

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Loads dropped DLL 9 IoCs

pid	Process
2804	Rundll32.exe
2804	Rundll32.exe
2804	Rundll32.exe
2804	Rundll32.exe
1960	Rundll32.exe
1960	Rundll32.exe
1960	Rundll32.exe
1960	Rundll32.exe
1960	Rundll32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\system = "C:\\Windows\\system32\\system.exe"	Rundll32.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\mkbcvctb.dll	708abe50048782def5929bc281362498_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\befcvctb.dll	708abe50048782def5929bc281362498_JaffaCakes118.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\RAV\CDriver.sys	Rundll32.exe
File opened for modification	C:\Program Files\RAV\CDriver.Inf	Rundll32.exe

Launches sc.exe 23 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2036	sc.exe
2332	sc.exe
596	sc.exe
2364	sc.exe
2712	sc.exe
552	sc.exe
2524	sc.exe
2988	sc.exe
2972	sc.exe
952	sc.exe
2668	sc.exe
2624	sc.exe
2764	sc.exe
2760	sc.exe
1096	sc.exe
1332	sc.exe
264	sc.exe
2888	sc.exe
848	sc.exe
2844	sc.exe
2144	sc.exe
2632	sc.exe
1128	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 26 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	708abe50048782def5929bc281362498_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2804	Rundll32.exe
2804	Rundll32.exe
2804	Rundll32.exe
1960	Rundll32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2808	708abe50048782def5929bc281362498_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeRestorePrivilege	2804	Rundll32.exe
Token: SeRestorePrivilege	2804	Rundll32.exe
Token: SeRestorePrivilege	2804	Rundll32.exe
Token: SeRestorePrivilege	2804	Rundll32.exe
Token: SeRestorePrivilege	2804	Rundll32.exe
Token: SeRestorePrivilege	2804	Rundll32.exe
Token: SeRestorePrivilege	2804	Rundll32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 2804	2808	708abe50048782def5929bc281362498_JaffaCakes118.exe	30
PID 2808 wrote to memory of 2804	2808	708abe50048782def5929bc281362498_JaffaCakes118.exe	30
PID 2808 wrote to memory of 2804	2808	708abe50048782def5929bc281362498_JaffaCakes118.exe	30
PID 2808 wrote to memory of 2804	2808	708abe50048782def5929bc281362498_JaffaCakes118.exe	30
PID 2808 wrote to memory of 2804	2808	708abe50048782def5929bc281362498_JaffaCakes118.exe	30
PID 2808 wrote to memory of 2804	2808	708abe50048782def5929bc281362498_JaffaCakes118.exe	30
PID 2808 wrote to memory of 2804	2808	708abe50048782def5929bc281362498_JaffaCakes118.exe	30
PID 2804 wrote to memory of 2364	2804	Rundll32.exe	31
PID 2804 wrote to memory of 2364	2804	Rundll32.exe	31
PID 2804 wrote to memory of 2364	2804	Rundll32.exe	31
PID 2804 wrote to memory of 2364	2804	Rundll32.exe	31
PID 2804 wrote to memory of 2888	2804	Rundll32.exe	32
PID 2804 wrote to memory of 2888	2804	Rundll32.exe	32
PID 2804 wrote to memory of 2888	2804	Rundll32.exe	32
PID 2804 wrote to memory of 2888	2804	Rundll32.exe	32
PID 2804 wrote to memory of 2712	2804	Rundll32.exe	34
PID 2804 wrote to memory of 2712	2804	Rundll32.exe	34
PID 2804 wrote to memory of 2712	2804	Rundll32.exe	34
PID 2804 wrote to memory of 2712	2804	Rundll32.exe	34
PID 2804 wrote to memory of 2844	2804	Rundll32.exe	35
PID 2804 wrote to memory of 2844	2804	Rundll32.exe	35
PID 2804 wrote to memory of 2844	2804	Rundll32.exe	35
PID 2804 wrote to memory of 2844	2804	Rundll32.exe	35
PID 2804 wrote to memory of 2988	2804	Rundll32.exe	37
PID 2804 wrote to memory of 2988	2804	Rundll32.exe	37
PID 2804 wrote to memory of 2988	2804	Rundll32.exe	37
PID 2804 wrote to memory of 2988	2804	Rundll32.exe	37
PID 2804 wrote to memory of 2760	2804	Rundll32.exe	40
PID 2804 wrote to memory of 2760	2804	Rundll32.exe	40
PID 2804 wrote to memory of 2760	2804	Rundll32.exe	40
PID 2804 wrote to memory of 2760	2804	Rundll32.exe	40
PID 2804 wrote to memory of 2764	2804	Rundll32.exe	41
PID 2804 wrote to memory of 2764	2804	Rundll32.exe	41
PID 2804 wrote to memory of 2764	2804	Rundll32.exe	41
PID 2804 wrote to memory of 2764	2804	Rundll32.exe	41
PID 2804 wrote to memory of 2036	2804	Rundll32.exe	43
PID 2804 wrote to memory of 2036	2804	Rundll32.exe	43
PID 2804 wrote to memory of 2036	2804	Rundll32.exe	43
PID 2804 wrote to memory of 2036	2804	Rundll32.exe	43
PID 2804 wrote to memory of 2624	2804	Rundll32.exe	46
PID 2804 wrote to memory of 2624	2804	Rundll32.exe	46
PID 2804 wrote to memory of 2624	2804	Rundll32.exe	46
PID 2804 wrote to memory of 2624	2804	Rundll32.exe	46
PID 2804 wrote to memory of 2668	2804	Rundll32.exe	48
PID 2804 wrote to memory of 2668	2804	Rundll32.exe	48
PID 2804 wrote to memory of 2668	2804	Rundll32.exe	48
PID 2804 wrote to memory of 2668	2804	Rundll32.exe	48
PID 2804 wrote to memory of 952	2804	Rundll32.exe	49
PID 2804 wrote to memory of 952	2804	Rundll32.exe	49
PID 2804 wrote to memory of 952	2804	Rundll32.exe	49
PID 2804 wrote to memory of 952	2804	Rundll32.exe	49
PID 2804 wrote to memory of 848	2804	Rundll32.exe	50
PID 2804 wrote to memory of 848	2804	Rundll32.exe	50
PID 2804 wrote to memory of 848	2804	Rundll32.exe	50
PID 2804 wrote to memory of 848	2804	Rundll32.exe	50
PID 2804 wrote to memory of 596	2804	Rundll32.exe	53
PID 2804 wrote to memory of 596	2804	Rundll32.exe	53
PID 2804 wrote to memory of 596	2804	Rundll32.exe	53
PID 2804 wrote to memory of 596	2804	Rundll32.exe	53
PID 2804 wrote to memory of 264	2804	Rundll32.exe	54
PID 2804 wrote to memory of 264	2804	Rundll32.exe	54
PID 2804 wrote to memory of 264	2804	Rundll32.exe	54
PID 2804 wrote to memory of 264	2804	Rundll32.exe	54
PID 2804 wrote to memory of 1332	2804	Rundll32.exe	56

C:\Users\Admin\AppData\Local\Temp\708abe50048782def5929bc281362498_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\708abe50048782def5929bc281362498_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Windows\SysWOW64\Rundll32.exe
  Rundll32 C:\Windows\system32\mkbcvctb.dll Execute
  2⤵
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2804
- - C:\Windows\SysWOW64\sc.exe
    sc stop ZhuDongFangYu
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2364
- - C:\Windows\SysWOW64\sc.exe
    sc delete ZhuDongFangYu
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2888
- - C:\Windows\SysWOW64\sc.exe
    sc stop 360rp
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2712
- - C:\Windows\SysWOW64\sc.exe
    sc delete 360rp
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2844
- - C:\Windows\SysWOW64\sc.exe
    sc stop RsRavMon
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2988
- - C:\Windows\SysWOW64\sc.exe
    sc delete RsRavMon
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2760
- - C:\Windows\SysWOW64\sc.exe
    sc stop McNASvc
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2764
- - C:\Windows\SysWOW64\sc.exe
    sc delete McNASvc
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2036
- - C:\Windows\SysWOW64\sc.exe
    sc stop MpfService
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2624
- - C:\Windows\SysWOW64\sc.exe
    sc delete MpfService
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2668
- - C:\Windows\SysWOW64\sc.exe
    sc stop McProxy
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:952
- - C:\Windows\SysWOW64\sc.exe
    sc delete McProxy
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:848
- - C:\Windows\SysWOW64\sc.exe
    sc stop McShield
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:596
- - C:\Windows\SysWOW64\sc.exe
    sc delete McShield
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:264
- - C:\Windows\SysWOW64\sc.exe
    sc stop McODS
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1332
- - C:\Windows\SysWOW64\sc.exe
    sc delete McODS
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1096
- - C:\Windows\SysWOW64\sc.exe
    sc stop mcmscsvc
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2972
- - C:\Windows\SysWOW64\sc.exe
    sc delete mcmscsvc
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:552
- - C:\Windows\SysWOW64\sc.exe
    sc stop McSysmon
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2332
- - C:\Windows\SysWOW64\sc.exe
    sc delete McSysmon
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2632
- - C:\Windows\SysWOW64\sc.exe
    sc stop ekrn
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2144
- - C:\Windows\SysWOW64\sc.exe
    sc delete ekrn
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2524
- - C:\Windows\SysWOW64\sc.exe
    "C:\Windows\System32\sc.exe" stop PolicyAgent
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1128
- C:\Windows\SysWOW64\Rundll32.exe
  Rundll32 C:\Windows\system32\befcvctb.dll Execute
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\befcvctb.dll

Filesize
8KB

MD5
d49e24aaddb6de1d7e04f353197fe210

SHA1
439cd17010d7af7acfdae45e83cea09f338a67dc

SHA256
660bd04c6abdfd1b385abf4a0c79f9eef1007aa2fcd6f7e53b31a3145a062045

SHA512
4079b2afdfd2076ce6931640de70617fc27bcf26d09846de80ff238c312504959a117761f7ccb52ad38914d2392bbac0ac7d3bb8981d55e8d663e00e492a5146

Download Submit
C:\Windows\SysWOW64\mkbcvctb.dll

Filesize
26KB

MD5
d4e567f4e233ab037c7dc12c924ee5d6

SHA1
c9af7da5c7bae85e248f1f80db5d82dc2f3af6d3

SHA256
e59a90649bf2c03712aa1cf08c93b50a683e05802465672f2f351765e3fd1556

SHA512
ce6e35aa54d428a71746f6a4c38b78273208e0658e1377384c3d5e330c80780dd6770a85dcbf49fc4c08b4f8fbf2933b66b3daa2698c939381ffeb83d9ef2883

Download Submit
\Users\Admin\AppData\Local\Temp\6B51.tmp

Filesize
1.7MB

MD5
b5eb5bd3066959611e1f7a80fd6cc172

SHA1
6fb1532059212c840737b3f923a9c0b152c0887a

SHA256
1ffb68a66f28f604adcae9c135f8dcf301316ab7fda8ebd294583c56dd26f7cc

SHA512
6c0743e0ff4922e859ba66b68040ab994dbae33e80c63ce8c993ad31a0c7aad6c6467484da1550063214953cd641dbf597438dd0c02f24164505d88ca80ea1b6

Download Submit
memory/2804-12-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download