5fd6fcc42844bde31ff247a7da67e27d656e0b483d0e18f1cdc69771791fadf9

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
27-07-2024 11:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

77f5660ea571e8635dab40fa675075d6_JaffaCakes118.exe
Size

293KB
MD5

77f5660ea571e8635dab40fa675075d6
SHA1

5688465cfe980dad02a26e0a044c66cbd99196cb
SHA256

5fd6fcc42844bde31ff247a7da67e27d656e0b483d0e18f1cdc69771791fadf9
SHA512

3450200d3c6f35ea3949cefdd821058cf743a5ed96deee2cb2d25c68e7a420e2882a4c424ce60c4f4e265251ed738bbb66cf9db7c3c37b1736ab6f3a00263352
SSDEEP

6144:+dU2lujG4hXZo1CYBLpTcM5iwxIaxJ5jh9NUVCKY3zEtOCNBkOmwlpg:oU2ltCcjbTcDwxlxJ57aC3zEtzNurws

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5028	services.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\pchealth\helpctr\binaries\services.exe	77f5660ea571e8635dab40fa675075d6_JaffaCakes118.exe
File opened for modification	C:\Windows\pchealth\helpctr\binaries\services.exe	77f5660ea571e8635dab40fa675075d6_JaffaCakes118.exe
File created	C:\Windows\DELME.BAT	77f5660ea571e8635dab40fa675075d6_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	77f5660ea571e8635dab40fa675075d6_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	services.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	services.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	services.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	services.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	services.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4860	77f5660ea571e8635dab40fa675075d6_JaffaCakes118.exe
Token: SeDebugPrivilege	5028	services.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5028	services.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4860 wrote to memory of 688	4860	77f5660ea571e8635dab40fa675075d6_JaffaCakes118.exe	92
PID 4860 wrote to memory of 688	4860	77f5660ea571e8635dab40fa675075d6_JaffaCakes118.exe	92
PID 4860 wrote to memory of 688	4860	77f5660ea571e8635dab40fa675075d6_JaffaCakes118.exe	92

C:\Users\Admin\AppData\Local\Temp\77f5660ea571e8635dab40fa675075d6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\77f5660ea571e8635dab40fa675075d6_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4860
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\DELME.BAT
  2⤵
  - System Location Discovery: System Language Discovery
  PID:688

C:\Windows\pchealth\helpctr\binaries\services.exe
C:\Windows\pchealth\helpctr\binaries\services.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\DELME.BAT

Filesize
218B

MD5
9e86437564a391ed3540f9ece6d206dc

SHA1
af82efc6607f5e21dfa1a23f51457eea9ce3ba6d

SHA256
880525711e2dd1dee91f145141b1ba0ff7670a9b0ec4e88feff272397d1a4d00

SHA512
db2c06e451756f1180c89f9ce4210aebf5cd4644d058604973f9251eb5b573f06eda780d9c343a8833ec5cf701db6121538330a06d1b16f67bd29a3f50c84858

Download Submit
C:\Windows\pchealth\helpctr\binaries\services.exe

Filesize
293KB

MD5
77f5660ea571e8635dab40fa675075d6

SHA1
5688465cfe980dad02a26e0a044c66cbd99196cb

SHA256
5fd6fcc42844bde31ff247a7da67e27d656e0b483d0e18f1cdc69771791fadf9

SHA512
3450200d3c6f35ea3949cefdd821058cf743a5ed96deee2cb2d25c68e7a420e2882a4c424ce60c4f4e265251ed738bbb66cf9db7c3c37b1736ab6f3a00263352

Download Submit
memory/4860-0-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/4860-1-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/4860-2-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/4860-3-0x0000000000A30000-0x0000000000A31000-memory.dmp

Filesize
4KB

Download
memory/4860-12-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/5028-8-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/5028-9-0x00000000011C0000-0x00000000011C1000-memory.dmp

Filesize
4KB

Download
memory/5028-14-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/5028-15-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/5028-16-0x00000000011C0000-0x00000000011C1000-memory.dmp

Filesize
4KB

Download