97d62d9cc4e33d23b3a9560d5a4dabf3cc95ffa2b2a029adde9445f568c15b51

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
10/08/2024, 04:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

84c358e8c1d21ce99e8faf125b94cc31_JaffaCakes118.exe
Size

14KB
MD5

84c358e8c1d21ce99e8faf125b94cc31
SHA1

d25b7408d938e8156766e01ee3d960434257b95e
SHA256

97d62d9cc4e33d23b3a9560d5a4dabf3cc95ffa2b2a029adde9445f568c15b51
SHA512

99928f8988bfa8b3b70d00204e0d5f0f11994db97d789e65e55dd4805099d818d2d3880fe6d9b6788fe8bbcecf4d75dc5145bc781d1f68925767397cb50a2d24
SSDEEP

384:5dmHImwx5lmuKIp4kFJvAI8IWRCmV/nvRCi:5dbmwSI2kF6ILmZnb

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\adsntzt.dll = "{00010001-0001-0001-0001-00010001BB15}"	84c358e8c1d21ce99e8faf125b94cc31_JaffaCakes118.exe

Loads dropped DLL 1 IoCs

pid	Process
1228	84c358e8c1d21ce99e8faf125b94cc31_JaffaCakes118.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\adsntzt.tmp	84c358e8c1d21ce99e8faf125b94cc31_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\adsntzt.tmp	84c358e8c1d21ce99e8faf125b94cc31_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\adsntzt.nls	84c358e8c1d21ce99e8faf125b94cc31_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	84c358e8c1d21ce99e8faf125b94cc31_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00010001-0001-0001-0001-00010001BB15}\InProcServer32	84c358e8c1d21ce99e8faf125b94cc31_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00010001-0001-0001-0001-00010001BB15}\InProcServer32\ = "C:\\Windows\\SysWow64\\adsntzt.dll"	84c358e8c1d21ce99e8faf125b94cc31_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00010001-0001-0001-0001-00010001BB15}\InProcServer32\ThreadingModel = "Apartment"	84c358e8c1d21ce99e8faf125b94cc31_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00010001-0001-0001-0001-00010001BB15}	84c358e8c1d21ce99e8faf125b94cc31_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1228	84c358e8c1d21ce99e8faf125b94cc31_JaffaCakes118.exe
1228	84c358e8c1d21ce99e8faf125b94cc31_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1228	84c358e8c1d21ce99e8faf125b94cc31_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1228 wrote to memory of 2300	1228	84c358e8c1d21ce99e8faf125b94cc31_JaffaCakes118.exe	95
PID 1228 wrote to memory of 2300	1228	84c358e8c1d21ce99e8faf125b94cc31_JaffaCakes118.exe	95
PID 1228 wrote to memory of 2300	1228	84c358e8c1d21ce99e8faf125b94cc31_JaffaCakes118.exe	95

C:\Users\Admin\AppData\Local\Temp\84c358e8c1d21ce99e8faf125b94cc31_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\84c358e8c1d21ce99e8faf125b94cc31_JaffaCakes118.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1228
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\3F37.tmp.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3F37.tmp.bat

Filesize
207B

MD5
d6063ce6fbd00ca6fb6bf6c212dface4

SHA1
c0da1e3fdb21445a4c190905ec5518fd2a432e07

SHA256
ca424c8039f9c84b9fe91edcd37d5c1560e1f2529599f1a2d63a72e483750ef6

SHA512
c9bbee51dd118163b682e259c46a9059affae06d4c0c00ff6c5b132027e5079fffd5d845e625bf6d9f4692e59395607672607e5a97acfc3985a94fdc8211bed6

Download Submit
C:\Windows\SysWOW64\adsntzt.dll

Filesize
992KB

MD5
36f7d90be12af2c8cbf34074e08f47e9

SHA1
b084e34fd88cffb1e8ee2535cb474d2d55e92025

SHA256
78313b3e05398d61214088d4d7150ed1eaead378eeed06fac22e5078260092b8

SHA512
781d1a94b5fa7e654e59526e1f1e65c9dd127cc5bb1fc03b738c141739197674767d42b5044ab611953fc7c65032697d419b18662222a5045cb3bf6dadcdaa9e

Download Submit