27402b880603cda1dbdab2ec37d774328493b488c06cc41ce9a9ab85a295fbf9

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
28/07/2024, 04:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
09318b28ecd23ce09651688c36d407db_JaffaCakes118.exe
Size 43KB
Sample240728-e5x22s1gmd
SHA256 27402b880603cda1dbdab2ec37d774328493b488c06cc41ce9a9ab85a295fbf9
MD5 09318b28ecd23ce09651688c36d407db
SHA1 d1299521b1153a8cb23cd029ba472ae2e3ed1f19
SHA512 3621b6b5ab291fcf4584597214e36597fc49022fe25505352772e46207d285eee25d36eb8bae74e09779c5639ff2b159abb541d343ff1a139c5b731a805d3526
SSDEEP 384:wZy/4KdnOFohMFsyi8J1mf4r7tMEjgnHBOm9D9O5UE5QzwBlpJNakkjh/TzF7pWb:2je6Fpi4AcQcvQO+Bu+L
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	09318b28ecd23ce09651688c36d407db_JaffaCakes118.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Process Manager.exe	WinSystemt.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Process Manager.exe	WinSystemt.exe

Executes dropped EXE 4 IoCs

pid	Process
1820	WinSystemt.exe
1348	Server.exe
3180	Server.exe
2032	Server.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Process Manager = "\"C:\\Windows\\WinSystemt.exe\" .."	WinSystemt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Process Manager = "\"C:\\Windows\\WinSystemt.exe\" .."	WinSystemt.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\WinSystemt.exe	09318b28ecd23ce09651688c36d407db_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSystemt.exe	WinSystemt.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	09318b28ecd23ce09651688c36d407db_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinSystemt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4500	schtasks.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1040	09318b28ecd23ce09651688c36d407db_JaffaCakes118.exe
1820	WinSystemt.exe

Suspicious use of AdjustPrivilegeToken 33 IoCs

description	pid	Process
Token: SeDebugPrivilege	1820	WinSystemt.exe
Token: 33	1820	WinSystemt.exe
Token: SeIncBasePriorityPrivilege	1820	WinSystemt.exe
Token: 33	1820	WinSystemt.exe
Token: SeIncBasePriorityPrivilege	1820	WinSystemt.exe
Token: 33	1820	WinSystemt.exe
Token: SeIncBasePriorityPrivilege	1820	WinSystemt.exe
Token: 33	1820	WinSystemt.exe
Token: SeIncBasePriorityPrivilege	1820	WinSystemt.exe
Token: 33	1820	WinSystemt.exe
Token: SeIncBasePriorityPrivilege	1820	WinSystemt.exe
Token: 33	1820	WinSystemt.exe
Token: SeIncBasePriorityPrivilege	1820	WinSystemt.exe
Token: 33	1820	WinSystemt.exe
Token: SeIncBasePriorityPrivilege	1820	WinSystemt.exe
Token: 33	1820	WinSystemt.exe
Token: SeIncBasePriorityPrivilege	1820	WinSystemt.exe
Token: 33	1820	WinSystemt.exe
Token: SeIncBasePriorityPrivilege	1820	WinSystemt.exe
Token: 33	1820	WinSystemt.exe
Token: SeIncBasePriorityPrivilege	1820	WinSystemt.exe
Token: 33	1820	WinSystemt.exe
Token: SeIncBasePriorityPrivilege	1820	WinSystemt.exe
Token: 33	1820	WinSystemt.exe
Token: SeIncBasePriorityPrivilege	1820	WinSystemt.exe
Token: 33	1820	WinSystemt.exe
Token: SeIncBasePriorityPrivilege	1820	WinSystemt.exe
Token: 33	1820	WinSystemt.exe
Token: SeIncBasePriorityPrivilege	1820	WinSystemt.exe
Token: 33	1820	WinSystemt.exe
Token: SeIncBasePriorityPrivilege	1820	WinSystemt.exe
Token: 33	1820	WinSystemt.exe
Token: SeIncBasePriorityPrivilege	1820	WinSystemt.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1040 wrote to memory of 1820	1040	09318b28ecd23ce09651688c36d407db_JaffaCakes118.exe	92
PID 1040 wrote to memory of 1820	1040	09318b28ecd23ce09651688c36d407db_JaffaCakes118.exe	92
PID 1040 wrote to memory of 1820	1040	09318b28ecd23ce09651688c36d407db_JaffaCakes118.exe	92
PID 1820 wrote to memory of 4500	1820	WinSystemt.exe	96
PID 1820 wrote to memory of 4500	1820	WinSystemt.exe	96
PID 1820 wrote to memory of 4500	1820	WinSystemt.exe	96

C:\Users\Admin\AppData\Local\Temp\09318b28ecd23ce09651688c36d407db_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\09318b28ecd23ce09651688c36d407db_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1040
- C:\Windows\WinSystemt.exe
  "C:\Windows\WinSystemt.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1820
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\Admin\AppData\Local\Temp/Server.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4500

C:\Users\Admin\AppData\Local\Temp\Server.exe
C:\Users\Admin\AppData\Local\Temp/Server.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1348

C:\Users\Admin\AppData\Local\Temp\Server.exe
C:\Users\Admin\AppData\Local\Temp/Server.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3180

C:\Users\Admin\AppData\Local\Temp\Server.exe
C:\Users\Admin\AppData\Local\Temp/Server.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Server.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\Server.exe.log
Size 408B
SHA256 b9520170e84597186ba5cc223b9c2773f70d0cda088950bae2182e3b2237995c
MD5 42157868488d3ef98c00e3fa12f064be
SHA1 aad391be9ac3f6ce1ced49583690486a5f4186fb
SHA512 8f4a4bd63ceefc34158ea23f3a73dcc2848eeacdba8355d1251a96b4e0c18e2f3b0c4939be359f874f81fe4ee63283b8be43a70fe2dbaa2e64784333d10a2471
MD5 SHA1 SHA512

Submit Download

WinSystemt.exe

Path C:\Windows\WinSystemt.exe
Size 43KB
SHA256 27402b880603cda1dbdab2ec37d774328493b488c06cc41ce9a9ab85a295fbf9
MD5 09318b28ecd23ce09651688c36d407db
SHA1 d1299521b1153a8cb23cd029ba472ae2e3ed1f19
SHA512 3621b6b5ab291fcf4584597214e36597fc49022fe25505352772e46207d285eee25d36eb8bae74e09779c5639ff2b159abb541d343ff1a139c5b731a805d3526
SSDEEP 384:wZy/4KdnOFohMFsyi8J1mf4r7tMEjgnHBOm9D9O5UE5QzwBlpJNakkjh/TzF7pWb:2je6Fpi4AcQcvQO+Bu+L
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1040-0-0x00000000753C2000-0x00000000753C3000-memory.dmp

Download

memory/1040-1-0x00000000753C0000-0x0000000075971000-memory.dmp

Download

memory/1040-2-0x00000000753C0000-0x0000000075971000-memory.dmp

Download

memory/1040-12-0x00000000753C0000-0x0000000075971000-memory.dmp

Download

memory/1348-18-0x00000000753C0000-0x0000000075971000-memory.dmp

Download

memory/1348-20-0x00000000753C0000-0x0000000075971000-memory.dmp

Download

memory/1820-13-0x00000000753C0000-0x0000000075971000-memory.dmp

Download

memory/1820-21-0x00000000753C0000-0x0000000075971000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads