29d9112141942b8d398e4a8013061e409af130412b3f886ae5a42d12d6526738

Analysis

max time kernel
150s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
01-08-2024 21:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

81c99e9f40b36b9f8201bf47b974b087_JaffaCakes118.exe
Size

79KB
MD5

81c99e9f40b36b9f8201bf47b974b087
SHA1

8454764e151bf8622541abd7f608e69dea701e30
SHA256

29d9112141942b8d398e4a8013061e409af130412b3f886ae5a42d12d6526738
SHA512

af1c1b61395f455b07d95bef1b308af9fc6e3266fc720fd0eea02220165b4304f81ade119badd3ff77e48710d0bb421fcd26801ec0090fc599e34c8c9432d1f8
SSDEEP

1536:vbJUWIcJuPQWr5B/lAMG83RheVPGSFPT:jSWIpr5BnhIFF7

Score

8^/10

discovery evasion execution persistence

Malware Config

Signatures

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Loads dropped DLL 3 IoCs

pid	Process
4016	Rundll32.exe
2676	Rundll32.exe
2676	Rundll32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\system = "C:\\Windows\\system32\\system.exe"	Rundll32.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rqpa.dll	81c99e9f40b36b9f8201bf47b974b087_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\iipa.dll	81c99e9f40b36b9f8201bf47b974b087_JaffaCakes118.exe

Launches sc.exe 20 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3636	sc.exe
2792	sc.exe
1948	sc.exe
4460	sc.exe
920	sc.exe
2124	sc.exe
4360	sc.exe
2916	sc.exe
3548	sc.exe
4744	sc.exe
872	sc.exe
3896	sc.exe
4324	sc.exe
4256	sc.exe
3432	sc.exe
3080	sc.exe
3852	sc.exe
3416	sc.exe
1956	sc.exe
2744	sc.exe

System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	81c99e9f40b36b9f8201bf47b974b087_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4016	Rundll32.exe
4016	Rundll32.exe
4016	Rundll32.exe
4016	Rundll32.exe
4016	Rundll32.exe
4016	Rundll32.exe
4016	Rundll32.exe
4016	Rundll32.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
660	Process not Found

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4732	81c99e9f40b36b9f8201bf47b974b087_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4732 wrote to memory of 4016	4732	81c99e9f40b36b9f8201bf47b974b087_JaffaCakes118.exe	83
PID 4732 wrote to memory of 4016	4732	81c99e9f40b36b9f8201bf47b974b087_JaffaCakes118.exe	83
PID 4732 wrote to memory of 4016	4732	81c99e9f40b36b9f8201bf47b974b087_JaffaCakes118.exe	83
PID 4016 wrote to memory of 4744	4016	Rundll32.exe	85
PID 4016 wrote to memory of 4744	4016	Rundll32.exe	85
PID 4016 wrote to memory of 4744	4016	Rundll32.exe	85
PID 4016 wrote to memory of 920	4016	Rundll32.exe	86
PID 4016 wrote to memory of 920	4016	Rundll32.exe	86
PID 4016 wrote to memory of 920	4016	Rundll32.exe	86
PID 4016 wrote to memory of 3548	4016	Rundll32.exe	87
PID 4016 wrote to memory of 3548	4016	Rundll32.exe	87
PID 4016 wrote to memory of 3548	4016	Rundll32.exe	87
PID 4016 wrote to memory of 2916	4016	Rundll32.exe	88
PID 4016 wrote to memory of 2916	4016	Rundll32.exe	88
PID 4016 wrote to memory of 2916	4016	Rundll32.exe	88
PID 4016 wrote to memory of 3416	4016	Rundll32.exe	89
PID 4016 wrote to memory of 3416	4016	Rundll32.exe	89
PID 4016 wrote to memory of 3416	4016	Rundll32.exe	89
PID 4016 wrote to memory of 4324	4016	Rundll32.exe	90
PID 4016 wrote to memory of 4324	4016	Rundll32.exe	90
PID 4016 wrote to memory of 4324	4016	Rundll32.exe	90
PID 4016 wrote to memory of 2792	4016	Rundll32.exe	91
PID 4016 wrote to memory of 2792	4016	Rundll32.exe	91
PID 4016 wrote to memory of 2792	4016	Rundll32.exe	91
PID 4016 wrote to memory of 3080	4016	Rundll32.exe	92
PID 4016 wrote to memory of 3080	4016	Rundll32.exe	92
PID 4016 wrote to memory of 3080	4016	Rundll32.exe	92
PID 4016 wrote to memory of 872	4016	Rundll32.exe	95
PID 4016 wrote to memory of 872	4016	Rundll32.exe	95
PID 4016 wrote to memory of 872	4016	Rundll32.exe	95
PID 4016 wrote to memory of 3636	4016	Rundll32.exe	96
PID 4016 wrote to memory of 3636	4016	Rundll32.exe	96
PID 4016 wrote to memory of 3636	4016	Rundll32.exe	96
PID 4016 wrote to memory of 3852	4016	Rundll32.exe	97
PID 4016 wrote to memory of 3852	4016	Rundll32.exe	97
PID 4016 wrote to memory of 3852	4016	Rundll32.exe	97
PID 4016 wrote to memory of 3896	4016	Rundll32.exe	100
PID 4016 wrote to memory of 3896	4016	Rundll32.exe	100
PID 4016 wrote to memory of 3896	4016	Rundll32.exe	100
PID 4016 wrote to memory of 4460	4016	Rundll32.exe	104
PID 4016 wrote to memory of 4460	4016	Rundll32.exe	104
PID 4016 wrote to memory of 4460	4016	Rundll32.exe	104
PID 4016 wrote to memory of 4360	4016	Rundll32.exe	105
PID 4016 wrote to memory of 4360	4016	Rundll32.exe	105
PID 4016 wrote to memory of 4360	4016	Rundll32.exe	105
PID 4016 wrote to memory of 4256	4016	Rundll32.exe	107
PID 4016 wrote to memory of 4256	4016	Rundll32.exe	107
PID 4016 wrote to memory of 4256	4016	Rundll32.exe	107
PID 4016 wrote to memory of 2124	4016	Rundll32.exe	108
PID 4016 wrote to memory of 2124	4016	Rundll32.exe	108
PID 4016 wrote to memory of 2124	4016	Rundll32.exe	108
PID 4016 wrote to memory of 1956	4016	Rundll32.exe	110
PID 4016 wrote to memory of 1956	4016	Rundll32.exe	110
PID 4016 wrote to memory of 1956	4016	Rundll32.exe	110
PID 4016 wrote to memory of 3432	4016	Rundll32.exe	112
PID 4016 wrote to memory of 3432	4016	Rundll32.exe	112
PID 4016 wrote to memory of 3432	4016	Rundll32.exe	112
PID 4016 wrote to memory of 2744	4016	Rundll32.exe	113
PID 4016 wrote to memory of 2744	4016	Rundll32.exe	113
PID 4016 wrote to memory of 2744	4016	Rundll32.exe	113
PID 4016 wrote to memory of 1948	4016	Rundll32.exe	115
PID 4016 wrote to memory of 1948	4016	Rundll32.exe	115
PID 4016 wrote to memory of 1948	4016	Rundll32.exe	115
PID 4016 wrote to memory of 4732	4016	Rundll32.exe	82

C:\Users\Admin\AppData\Local\Temp\81c99e9f40b36b9f8201bf47b974b087_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\81c99e9f40b36b9f8201bf47b974b087_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4732
- C:\Windows\SysWOW64\Rundll32.exe
  Rundll32 C:\Windows\system32\iipa.dll Execute
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4016
- - C:\Windows\SysWOW64\sc.exe
    sc stop 360rp
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4744
- - C:\Windows\SysWOW64\sc.exe
    sc delete 360rp
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:920
- - C:\Windows\SysWOW64\sc.exe
    sc stop RsRavMon
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3548
- - C:\Windows\SysWOW64\sc.exe
    sc delete RsRavMon
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2916
- - C:\Windows\SysWOW64\sc.exe
    sc stop McNASvc
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3416
- - C:\Windows\SysWOW64\sc.exe
    sc delete McNASvc
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4324
- - C:\Windows\SysWOW64\sc.exe
    sc stop MpfService
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2792
- - C:\Windows\SysWOW64\sc.exe
    sc delete MpfService
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3080
- - C:\Windows\SysWOW64\sc.exe
    sc stop McProxy
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:872
- - C:\Windows\SysWOW64\sc.exe
    sc delete McProxy
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3636
- - C:\Windows\SysWOW64\sc.exe
    sc stop McShield
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3852
- - C:\Windows\SysWOW64\sc.exe
    sc delete McShield
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3896
- - C:\Windows\SysWOW64\sc.exe
    sc stop McODS
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4460
- - C:\Windows\SysWOW64\sc.exe
    sc delete McODS
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4360
- - C:\Windows\SysWOW64\sc.exe
    sc stop mcmscsvc
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4256
- - C:\Windows\SysWOW64\sc.exe
    sc delete mcmscsvc
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2124
- - C:\Windows\SysWOW64\sc.exe
    sc stop McSysmon
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1956
- - C:\Windows\SysWOW64\sc.exe
    sc delete McSysmon
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3432
- - C:\Windows\SysWOW64\sc.exe
    sc stop ekrn
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2744
- - C:\Windows\SysWOW64\sc.exe
    sc delete ekrn
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1948
- C:\Windows\SysWOW64\Rundll32.exe
  Rundll32 C:\Windows\system32\rqpa.dll Execute
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Driver.sys

Filesize
11KB

MD5
5c06d52d07a39f36e04a05e5b565dbc2

SHA1
33daaf8afc98426f22da0395eb3b4da7d60f383b

SHA256
8373917a90395c6f6d88480939cbf3e5875caab93750e2b4520665b90f305d26

SHA512
030eeb0b90f2cf099251a7bab6a3ede3cb577710a1580464c18f089021f82a16386d8eba20634fa1cfacb9424c9b1a228f1189b7b85bed08ffc1c52b22c04156

Download Submit
C:\Users\Admin\AppData\Local\Temp\D6E7.tmp

Filesize
4.3MB

MD5
6c7cdd25c2cb0073306eb22aebfc663f

SHA1
a1eba8ab49272b9852fe6a543677e8af36271248

SHA256
58280e3572333f97a7cf9f33e8d31dc26a98b6535965ebd0bde82249fc9bf705

SHA512
17344e07b9e9b2cd6ae4237d7f310732462f9cbb8656883607d7a1a4090e869265f92a6da1718dee50b1375b91583de60c6bd9e7e8db6b6e45e33f4b894365d6

Download Submit
C:\Windows\SysWOW64\iipa.dll

Filesize
14KB

MD5
96db3b9aec3b3695fa13cbd594982ecf

SHA1
de05cc22d8393d08dfd9f1ee73cc3dba9733f748

SHA256
8e6fa1336ff0bd77e2e766e556a999dbcaa707469820879b0f5b0dfe9d7061dc

SHA512
b4e1cd02128c5e3d767b169b0d39e1682d7932eb5201c0e76750d6caad6869f8b6489101f08e9254444ac16f7f4f75f670dc07eb331a5758576edf19aff92c95

Download Submit
C:\Windows\SysWOW64\rqpa.dll

Filesize
8KB

MD5
5fd366e1f6dd7500fc0bfad1cd50c880

SHA1
faa0988a9c1a05145d9ab7325bdefb95e142b80c

SHA256
13be6c2e89c054911f42c8221dd85ee87f08b85588b55ae0879eb47a3d8664a4

SHA512
abf7f9db81c32d68ae4a6304f5992d9af7a4f0448b44d1f6fb90e9e08e41ba38ee7769f2125a21d1891a3c3e7ad57da96ebd00d727488b9f76758aa13559bd1b

Download Submit
memory/4732-5-0x0000000000BB0000-0x0000000000BB1000-memory.dmp

Filesize
4KB

Download