62411234ada1a2849710c898e14c8d93f514989c38a4ae42473a13985d725413

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
10/08/2024, 22:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
87fdeed72a35f12046230b25f53bf321_JaffaCakes118.exe
Size 361KB
Sample240810-2sdh7ssclk
SHA256 62411234ada1a2849710c898e14c8d93f514989c38a4ae42473a13985d725413
MD5 87fdeed72a35f12046230b25f53bf321
SHA1 805ec02c31f79738f5c10d7c0146c93a6bfc2d3c
SHA512 78dde7f1b07a86d0e34214e3ae72a50cdea04a70ea350cafc32eefc92ff59a0b12c9f3ed02ced7539320c0c16b9512913fc3ceab9e00a6557618cf39413902d2
SSDEEP 6144:qTHCYWjaJokQ7rg5v+XmRNWy2Ojz5ywWCbgpolzxELNGhpqg5kY:qT8mr6rgZ+2RMlSz5BWeco8LNGj5k
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
3492	upack.exe
2444	NoHacker.cn.exe
1824	upack.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	87fdeed72a35f12046230b25f53bf321_JaffaCakes118.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Media Player\NoHacker.cn.exe	upack.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\NoHacker.cn.exe	upack.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\NoHacker.cn.exe	upack.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\UNINSTAL.BAT	upack.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3904	3492	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NoHacker.cn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upack.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	87fdeed72a35f12046230b25f53bf321_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upack.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3492	upack.exe
Token: SeDebugPrivilege	2444	NoHacker.cn.exe
Token: SeDebugPrivilege	1824	upack.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2444	NoHacker.cn.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4064 wrote to memory of 3492	4064	87fdeed72a35f12046230b25f53bf321_JaffaCakes118.exe	84
PID 4064 wrote to memory of 3492	4064	87fdeed72a35f12046230b25f53bf321_JaffaCakes118.exe	84
PID 4064 wrote to memory of 3492	4064	87fdeed72a35f12046230b25f53bf321_JaffaCakes118.exe	84
PID 2444 wrote to memory of 1992	2444	NoHacker.cn.exe	89
PID 2444 wrote to memory of 1992	2444	NoHacker.cn.exe	89
PID 3492 wrote to memory of 3952	3492	upack.exe	93
PID 3492 wrote to memory of 3952	3492	upack.exe	93
PID 3492 wrote to memory of 3952	3492	upack.exe	93
PID 4064 wrote to memory of 1824	4064	87fdeed72a35f12046230b25f53bf321_JaffaCakes118.exe	95
PID 4064 wrote to memory of 1824	4064	87fdeed72a35f12046230b25f53bf321_JaffaCakes118.exe	95
PID 4064 wrote to memory of 1824	4064	87fdeed72a35f12046230b25f53bf321_JaffaCakes118.exe	95

C:\Users\Admin\AppData\Local\Temp\87fdeed72a35f12046230b25f53bf321_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\87fdeed72a35f12046230b25f53bf321_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4064
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\upack.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\upack.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3492
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 672
    3⤵
    - Program crash
    PID:3904
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\UNINSTAL.BAT
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3952
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\upack.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\upack.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1824

C:\Program Files (x86)\Windows Media Player\NoHacker.cn.exe
"C:\Program Files (x86)\Windows Media Player\NoHacker.cn.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:1992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3492 -ip 3492
1⤵
PID:2500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

upack.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\upack.exe
Size 322KB
SHA256 dd75d0b3da98fd19177afd1c2ab14fcccf736ccf116001869da2e5b62248e0ca
MD5 7abb5ba27169e383c3eec1030552d596
SHA1 d75dc4f78c15b4547bb41939975f2dc01dc8d4d7
SHA512 010b35aef7b6a0c43fe7a327ec9fc53581c0fdf0d61950234e8723313b5d7876b17cee956ec1c7b236be3564942a1ee4db8fa1705414a0b589a9f6be521c9aea
SSDEEP 6144:U4onVb1pljDfwHhBqCf6xFIPsIbSANOXG+AIYCzN3QjDegUC0Tq2cFC61FeUP4wK:9oVfBDfeHbCnq7nKvdfp3s3TF2cglwK
MD5 SHA1 SHA512 SSDEEP

Submit Download

UNINSTAL.BAT

Path C:\Windows\UNINSTAL.BAT
Size 154B
SHA256 d15821ee2b7de1fb83f19395524d2ac801a3adf10852f82f84163270d7dbf1c8
MD5 c7ee643bf371ce34d6d526fffd4d59f8
SHA1 115ef2e7cf228661ecd6f26e651906f41d2a4480
SHA512 a6649391c5dad4357da05818687cc70b8dfb90a44e9aef6c2be9c92ed038630dd5e04031aad58a1c3dc74fe48a71e23e7dbe78d7a78e571739734f208a4213c4
MD5 SHA1 SHA512

Submit Download

memory/1824-31-0x0000000000400000-0x0000000000FB1000-memory.dmp

Download

memory/2444-25-0x0000000001110000-0x0000000001111000-memory.dmp

Download

memory/2444-39-0x0000000001110000-0x0000000001111000-memory.dmp

Download

memory/2444-37-0x00000000010F0000-0x00000000010F1000-memory.dmp

Download

memory/2444-35-0x0000000000400000-0x0000000000FB1000-memory.dmp

Download

memory/2444-24-0x0000000000400000-0x0000000000FB1000-memory.dmp

Download

memory/2444-20-0x0000000000400000-0x0000000000FB1000-memory.dmp

Download

memory/3492-13-0x0000000002D10000-0x0000000002D11000-memory.dmp

Download

memory/3492-23-0x0000000002D10000-0x0000000002D11000-memory.dmp

Download

memory/3492-22-0x0000000000400000-0x0000000000FB1000-memory.dmp

Download

memory/3492-14-0x0000000000400000-0x0000000000FB1000-memory.dmp

Download

memory/3492-17-0x0000000002E40000-0x0000000002E41000-memory.dmp

Download

memory/3492-12-0x0000000000400000-0x0000000000FB1000-memory.dmp

Download

memory/4064-21-0x0000000001000000-0x00000000010BB000-memory.dmp

Download

memory/4064-0-0x0000000000400000-0x00000000004BE000-memory.dmp

Download

memory/4064-34-0x0000000001000000-0x00000000010BB000-memory.dmp

Download

memory/4064-33-0x0000000000400000-0x00000000004BE000-memory.dmp

Download

memory/4064-6-0x0000000001000000-0x00000000010BB000-memory.dmp

Download

memory/4064-1-0x0000000001000000-0x00000000010BB000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads