2be666e810f852aa54333425a40753bec5bf412903a3659ea8976fcea06e9585

Analysis

max time kernel
65s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
26/07/2024, 22:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

760baf3dde06e9de362a7d36054749dc_JaffaCakes118.exe
Size

16KB
MD5

760baf3dde06e9de362a7d36054749dc
SHA1

019899d20dbcf43644f316485bf87701d1bb16f3
SHA256

2be666e810f852aa54333425a40753bec5bf412903a3659ea8976fcea06e9585
SHA512

0b6ff7d6b80d994d164aee2877188849405b213df9653f357c1b5db20f85519bbf82e698996005bb6037e1dd634f753b829729285565c82353e3ff2c550b175b
SSDEEP

384:meW/Wu1BGOusV5iQalskxd6RHoPa8dnZfVQFxo7:+/VUQaGe6Bwa8PfVQFg

Score

8^/10

discovery persistence

Malware Config

Signatures

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\B1473CC4\ImagePath = "C:\\Windows\\system32\\9D413DB0.EXE -k"	760baf3dde06e9de362a7d36054749dc_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
4472	9D413DB0.EXE

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\9D413DB0.EXE	760baf3dde06e9de362a7d36054749dc_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\9D413DB0.EXE	760baf3dde06e9de362a7d36054749dc_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\9D413DB0.EXE	9D413DB0.EXE
File created	C:\Windows\SysWOW64\delme.bat	760baf3dde06e9de362a7d36054749dc_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\1ECBEB78.DLL	9D413DB0.EXE

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	760baf3dde06e9de362a7d36054749dc_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9D413DB0.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4472	9D413DB0.EXE
4472	9D413DB0.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeSystemtimePrivilege	4880	760baf3dde06e9de362a7d36054749dc_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4880 wrote to memory of 4728	4880	760baf3dde06e9de362a7d36054749dc_JaffaCakes118.exe	98
PID 4880 wrote to memory of 4728	4880	760baf3dde06e9de362a7d36054749dc_JaffaCakes118.exe	98
PID 4880 wrote to memory of 4728	4880	760baf3dde06e9de362a7d36054749dc_JaffaCakes118.exe	98

C:\Users\Admin\AppData\Local\Temp\760baf3dde06e9de362a7d36054749dc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\760baf3dde06e9de362a7d36054749dc_JaffaCakes118.exe"
1⤵
- Sets service image path in registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\delme.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4728

C:\Windows\SysWOW64\9D413DB0.EXE
C:\Windows\SysWOW64\9D413DB0.EXE -k
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\9D413DB0.EXE

Filesize
16KB

MD5
760baf3dde06e9de362a7d36054749dc

SHA1
019899d20dbcf43644f316485bf87701d1bb16f3

SHA256
2be666e810f852aa54333425a40753bec5bf412903a3659ea8976fcea06e9585

SHA512
0b6ff7d6b80d994d164aee2877188849405b213df9653f357c1b5db20f85519bbf82e698996005bb6037e1dd634f753b829729285565c82353e3ff2c550b175b

Download Submit
C:\Windows\SysWOW64\delme.bat

Filesize
239B

MD5
c76755b494271fcb966c83c48f760a48

SHA1
f094865d610aede50ac672c97a19cf913480a70b

SHA256
a404f93fb2379fa8c86735801baddc1290866a660cb8df5c52c399f61827e6b3

SHA512
e7fd8c5cf0161f7c0e5fc689b2575de660ea50893cfc66b4034774e32d77f3e08468e65ab0529966094aa7dd4336861ee252d4adb460051cbf2be8cb568b4ab0

Download Submit
memory/4472-7-0x0000000000580000-0x0000000000581000-memory.dmp

Filesize
4KB

Download
memory/4472-12-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/4880-0-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/4880-1-0x00000000006C0000-0x00000000006C1000-memory.dmp

Filesize
4KB

Download
memory/4880-2-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/4880-3-0x00000000006C0000-0x00000000006C1000-memory.dmp

Filesize
4KB

Download