efe438f027c6ff5a6b80a4642176141ddda0c2bdc081ed914999d878e084d066

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
27/07/2024, 05:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

772bc1a33bed6e7a8c3e2b0974ff550a_JaffaCakes118.exe
Size

476KB
MD5

772bc1a33bed6e7a8c3e2b0974ff550a
SHA1

4196ddb42254e377e8066d33f6a60be92bc3bd81
SHA256

efe438f027c6ff5a6b80a4642176141ddda0c2bdc081ed914999d878e084d066
SHA512

e952ab3ef6da8c3703c7a888efe1c081ad85e5e083b3ba4293590e162a80b40976f6777087185107b49e9fc5b87186c59eff11bcb5840cbc8d0e198307c8a420
SSDEEP

6144:ckMICtzWkvpia97cVsG9nJdxRh0R0VutL4O3igTVmTqL//VLJRLYOXTSbMyAG:ckmxnpia+1P0R0Vmv37T8TqRJB9XTSbB

Score

8^/10

discovery persistence

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y3417IF5-TD47-XG24-UIO8-6I1V14MSG53J}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y3417IF5-TD47-XG24-UIO8-6I1V14MSG53J}\StubPath = "C:\\Windows\\system32\\System32\\Explorer.exe Restart"	explorer.exe

Loads dropped DLL 3 IoCs

pid	Process
308	772bc1a33bed6e7a8c3e2b0974ff550a_JaffaCakes118.exe
308	772bc1a33bed6e7a8c3e2b0974ff550a_JaffaCakes118.exe
308	772bc1a33bed6e7a8c3e2b0974ff550a_JaffaCakes118.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\772bc1a33bed6e7a8c3e2b0974ff550a_JaffaCakes118.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe Picture Format\\Adobe Picture Format\\1.1.2.262\\772bc1a33bed6e7a8c3e2b0974ff550a_JaffaCakes118.exe"	772bc1a33bed6e7a8c3e2b0974ff550a_JaffaCakes118.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\System32\	explorer.exe
File created	C:\Windows\SysWOW64\System32\logse.dat	explorer.exe
File opened for modification	C:\Windows\SysWOW64\System32\logse.dat	explorer.exe
File created	C:\Windows\SysWOW64\System32\Explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\System32\Explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\System32\plugin.dat	explorer.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 308 set thread context of 560	308	772bc1a33bed6e7a8c3e2b0974ff550a_JaffaCakes118.exe	31

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	772bc1a33bed6e7a8c3e2b0974ff550a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
560	vbc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2952	explorer.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	560	vbc.exe
Token: SeDebugPrivilege	560	vbc.exe
Token: SeDebugPrivilege	560	vbc.exe
Token: SeDebugPrivilege	560	vbc.exe
Token: SeDebugPrivilege	2952	explorer.exe
Token: SeDebugPrivilege	2952	explorer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
560	vbc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 308 wrote to memory of 560	308	772bc1a33bed6e7a8c3e2b0974ff550a_JaffaCakes118.exe	31
PID 308 wrote to memory of 560	308	772bc1a33bed6e7a8c3e2b0974ff550a_JaffaCakes118.exe	31
PID 308 wrote to memory of 560	308	772bc1a33bed6e7a8c3e2b0974ff550a_JaffaCakes118.exe	31
PID 308 wrote to memory of 560	308	772bc1a33bed6e7a8c3e2b0974ff550a_JaffaCakes118.exe	31
PID 308 wrote to memory of 560	308	772bc1a33bed6e7a8c3e2b0974ff550a_JaffaCakes118.exe	31
PID 308 wrote to memory of 560	308	772bc1a33bed6e7a8c3e2b0974ff550a_JaffaCakes118.exe	31
PID 308 wrote to memory of 560	308	772bc1a33bed6e7a8c3e2b0974ff550a_JaffaCakes118.exe	31
PID 308 wrote to memory of 560	308	772bc1a33bed6e7a8c3e2b0974ff550a_JaffaCakes118.exe	31
PID 308 wrote to memory of 560	308	772bc1a33bed6e7a8c3e2b0974ff550a_JaffaCakes118.exe	31
PID 308 wrote to memory of 560	308	772bc1a33bed6e7a8c3e2b0974ff550a_JaffaCakes118.exe	31
PID 308 wrote to memory of 560	308	772bc1a33bed6e7a8c3e2b0974ff550a_JaffaCakes118.exe	31
PID 308 wrote to memory of 560	308	772bc1a33bed6e7a8c3e2b0974ff550a_JaffaCakes118.exe	31
PID 560 wrote to memory of 1176	560	vbc.exe	21
PID 560 wrote to memory of 1176	560	vbc.exe	21
PID 560 wrote to memory of 1176	560	vbc.exe	21
PID 560 wrote to memory of 1176	560	vbc.exe	21
PID 560 wrote to memory of 1176	560	vbc.exe	21
PID 560 wrote to memory of 1176	560	vbc.exe	21
PID 560 wrote to memory of 1176	560	vbc.exe	21
PID 560 wrote to memory of 1176	560	vbc.exe	21
PID 560 wrote to memory of 1176	560	vbc.exe	21
PID 560 wrote to memory of 1176	560	vbc.exe	21
PID 560 wrote to memory of 1176	560	vbc.exe	21
PID 560 wrote to memory of 1176	560	vbc.exe	21
PID 560 wrote to memory of 1176	560	vbc.exe	21
PID 560 wrote to memory of 1176	560	vbc.exe	21
PID 560 wrote to memory of 1176	560	vbc.exe	21
PID 560 wrote to memory of 1176	560	vbc.exe	21
PID 560 wrote to memory of 1176	560	vbc.exe	21
PID 560 wrote to memory of 1176	560	vbc.exe	21
PID 560 wrote to memory of 1176	560	vbc.exe	21
PID 560 wrote to memory of 1176	560	vbc.exe	21
PID 560 wrote to memory of 1176	560	vbc.exe	21
PID 560 wrote to memory of 1176	560	vbc.exe	21
PID 560 wrote to memory of 1176	560	vbc.exe	21
PID 560 wrote to memory of 1176	560	vbc.exe	21
PID 560 wrote to memory of 1176	560	vbc.exe	21
PID 560 wrote to memory of 1176	560	vbc.exe	21
PID 560 wrote to memory of 1176	560	vbc.exe	21
PID 560 wrote to memory of 1176	560	vbc.exe	21
PID 560 wrote to memory of 1176	560	vbc.exe	21
PID 560 wrote to memory of 1176	560	vbc.exe	21
PID 560 wrote to memory of 1176	560	vbc.exe	21
PID 560 wrote to memory of 1176	560	vbc.exe	21
PID 560 wrote to memory of 1176	560	vbc.exe	21
PID 560 wrote to memory of 1176	560	vbc.exe	21
PID 560 wrote to memory of 1176	560	vbc.exe	21
PID 560 wrote to memory of 1176	560	vbc.exe	21
PID 560 wrote to memory of 1176	560	vbc.exe	21
PID 560 wrote to memory of 1176	560	vbc.exe	21
PID 560 wrote to memory of 1176	560	vbc.exe	21
PID 560 wrote to memory of 1176	560	vbc.exe	21
PID 560 wrote to memory of 1176	560	vbc.exe	21
PID 560 wrote to memory of 1176	560	vbc.exe	21
PID 560 wrote to memory of 1176	560	vbc.exe	21
PID 560 wrote to memory of 1176	560	vbc.exe	21
PID 560 wrote to memory of 1176	560	vbc.exe	21
PID 560 wrote to memory of 1176	560	vbc.exe	21
PID 560 wrote to memory of 1176	560	vbc.exe	21
PID 560 wrote to memory of 1176	560	vbc.exe	21
PID 560 wrote to memory of 1176	560	vbc.exe	21
PID 560 wrote to memory of 1176	560	vbc.exe	21
PID 560 wrote to memory of 1176	560	vbc.exe	21
PID 560 wrote to memory of 1176	560	vbc.exe	21

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe
1⤵
PID:256

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:332

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:384
- C:\Windows\system32\services.exe
  C:\Windows\system32\services.exe
  2⤵
  PID:476
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    3⤵
    PID:604
  - - C:\Windows\system32\wbem\wmiprvse.exe
      C:\Windows\system32\wbem\wmiprvse.exe
      4⤵
      PID:1444
  - - C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
      4⤵
      PID:1600
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    3⤵
    PID:684
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    3⤵
    PID:768
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    3⤵
    PID:820
  - - C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      4⤵
      PID:1128
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    3⤵
    PID:848
  - - \\?\C:\Windows\system32\wbem\WMIADAP.EXE
      wmiadap.exe /F /T /R
      4⤵
      PID:2172
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService
    3⤵
    PID:968
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    3⤵
    PID:280
- - C:\Windows\System32\spoolsv.exe
    C:\Windows\System32\spoolsv.exe
    3⤵
    PID:1040
- - C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    3⤵
    PID:1056
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    3⤵
    PID:1116
- - C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
    "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
    3⤵
    PID:1260
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    3⤵
    PID:1572
- - C:\Windows\system32\sppsvc.exe
    C:\Windows\system32\sppsvc.exe
    3⤵
    PID:3012
- C:\Windows\system32\lsass.exe
  C:\Windows\system32\lsass.exe
  2⤵
  PID:492
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:500

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:396

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:432

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1176
- C:\Users\Admin\AppData\Local\Temp\772bc1a33bed6e7a8c3e2b0974ff550a_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\772bc1a33bed6e7a8c3e2b0974ff550a_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:308
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:560
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      PID:2952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe Picture Format\Adobe Picture Format\1.1.2.262\User32.dll

Filesize
18KB

MD5
5fa07d6c6384d703766d7935de68850e

SHA1
62f28a572b4d1d359db7017235912ad2599b8c1d

SHA256
120e15dcc4a957649553cd92a5477db9dcbfd9a2cd821e1c904044b5a92d726f

SHA512
7775375f44e0cb00f9bffc023d797dbdb01ebe8429ccfacd7df57beb04427ef309c192d571051242aad1bc400f721f449f86deeb1e5f5d64b6f516bf24e92cc4

Download Submit
memory/308-0-0x00000000741D1000-0x00000000741D2000-memory.dmp

Filesize
4KB

Download
memory/308-1-0x00000000741D0000-0x000000007477B000-memory.dmp

Filesize
5.7MB

Download
memory/308-2-0x00000000741D0000-0x000000007477B000-memory.dmp

Filesize
5.7MB

Download
memory/308-38-0x00000000741D0000-0x000000007477B000-memory.dmp

Filesize
5.7MB

Download
memory/560-30-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/560-37-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/560-24-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/560-26-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/560-28-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/560-20-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/560-32-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/560-34-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/560-36-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/560-22-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/560-35-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/560-18-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/560-15908-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1176-40-0x0000000002020000-0x0000000002021000-memory.dmp

Filesize
4KB

Download
memory/2952-1993-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/2952-2146-0x0000000000370000-0x0000000000371000-memory.dmp

Filesize
4KB

Download
memory/2952-4417-0x0000000010450000-0x0000000010481000-memory.dmp

Filesize
196KB

Download
memory/2952-15909-0x0000000010450000-0x0000000010481000-memory.dmp

Filesize
196KB

Download