0e5dfd156e579478d7d391540c13313becad75780c212e3ea9fa09a8a8b5f5d7

Analysis

max time kernel
124s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
10-08-2024 12:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8609393373af63e6a6e230839ea95480_JaffaCakes118.exe
Size

117KB
MD5

8609393373af63e6a6e230839ea95480
SHA1

cf15c3a177b9499232b6a301aaed9b7a636f32c7
SHA256

0e5dfd156e579478d7d391540c13313becad75780c212e3ea9fa09a8a8b5f5d7
SHA512

91392adb3be8c0342d8a7feb4a8814970410094d0b6e8c43f0a4e95a4346a172ae91a21a301bc3a65f18ad66b266c492707511db86efc8fcc0d5c1d2e1e11e66
SSDEEP

3072:mXobMMnDiwBQu0v89KoTFk++G0/adN3adcK:TpQJ89i++tadZ+

Score

8^/10

discovery upx

Malware Config

Signatures

Drops file in Drivers directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	cmd.exe
File opened for modification	C:\Windows\SysWOW64\drivers\afunix.sys	cmd.exe
File opened for modification	C:\Windows\SysWOW64\drivers\en-US\ndiscap.sys.mui	cmd.exe
File opened for modification	C:\Windows\SysWOW64\drivers\en-US\NdisImPlatform.sys.mui	cmd.exe
File opened for modification	C:\Windows\SysWOW64\drivers\en-US\wfplwfs.sys.mui	cmd.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gm.dls	cmd.exe

Manipulates Digital Signatures 2 IoCs

Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\pwrshsip.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\wintrust.dll	cmd.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5004-1-0x0000000000490000-0x00000000004EC000-memory.dmp	upx
behavioral2/memory/5004-4-0x0000000000800000-0x000000000082C000-memory.dmp	upx
behavioral2/memory/5004-7-0x0000000000800000-0x000000000082C000-memory.dmp	upx

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\DriverStore\fr-FR\iagpio.inf_loc	cmd.exe
File opened for modification	C:\Windows\SysWOW64\en-US\PhotoScreensaver.scr.mui	cmd.exe
File opened for modification	C:\Windows\SysWOW64\INETRES.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\it-IT\wlansvc.dll.mui	cmd.exe
File opened for modification	C:\Windows\SysWOW64\ja-JP\dsregtask.dll.mui	cmd.exe
File opened for modification	C:\Windows\SysWOW64\mferror.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\capisp.dll	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ACXHDA~1.INF\acxhdaudiop.inf	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\ja-JP\wvmic_kvpexchange.inf_loc	cmd.exe
File opened for modification	C:\Windows\SysWOW64\fi-FI\SyncRes.dll.mui	cmd.exe
File opened for modification	C:\Windows\SysWOW64\msls31.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\wbem\samsrv.mof	cmd.exe
File opened for modification	C:\Windows\SysWOW64\Windows.Devices.Printers.Extensions.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ArchiveResource\uk-UA\ArchiveProvider.psd1	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\it-IT\c_fsphysicalquotamgmt.inf_loc	cmd.exe
File opened for modification	C:\Windows\SysWOW64\MSAMRNBEncoder.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\dllhst3g.exe	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\wvmic_ext.inf_amd64_34d742f3550dabd2\wvmic_ext.inf	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\fr-FR\hal.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\ja-JP\iaLPSS2i_I2C_CNL.inf_loc	cmd.exe
File opened for modification	C:\Windows\SysWOW64\fi-FI\quickassist.exe.mui	cmd.exe
File opened for modification	C:\Windows\SysWOW64\ROUTE.EXE	cmd.exe
File opened for modification	C:\Windows\SysWOW64\de-DE\wlangpui.dll.mui	cmd.exe
File opened for modification	C:\Windows\SysWOW64\Dism\es-ES\SmiProvider.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\mdminfot.inf_amd64_564561a23e05c7ee\mdminfot.inf	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\nete1g3e.inf_amd64_af58b4e19562a3f9\nete1g3e.inf	cmd.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetTCPIP\MSFT_NetOffloadGlobalSetting.cdxml	cmd.exe
File opened for modification	C:\Windows\SysWOW64\de-DE\jscript.dll.mui	cmd.exe
File opened for modification	C:\Windows\SysWOW64\de-DE\scrptadm.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\fr-FR\netlldp.inf_loc	cmd.exe
File opened for modification	C:\Windows\SysWOW64\uk-UA\cmdl32.exe.mui	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\prnms005.inf_amd64_add71423ba73e797\Amd64\MSxpsXPS-manifest.ini	cmd.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\ScheduledTasks\PS_ScheduledTask_v1.0.cdxml	cmd.exe
File opened for modification	C:\Windows\SysWOW64\de-DE\wlanmm.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\mchgr.inf_amd64_399f04975a0af112\plasmc.sys	cmd.exe
File opened for modification	C:\Windows\SysWOW64\Geocommon.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\wlgpclnt.dll	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\de-DE\spaceport.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\c_fscfsmetadataserver.inf_amd64_ef3485e85c5c1b11\c_fscfsmetadataserver.inf	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\netathr10x.inf_amd64_2691c4f95b80eb3b\eeprom_ar6320_3p0_TX8_clpc.bin	cmd.exe
File opened for modification	C:\Windows\SysWOW64\PlayToStatusProvider.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WindowsOptionalFeature\es-ES\MSFT_WindowsOptionalFeature.schema.mfl	cmd.exe
File opened for modification	C:\Windows\SysWOW64\wksprtPS.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\Dism\de-DE\OSProvider.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\en-US\wnetvsc_vfpp.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\ja-JP\miradisp.inf_loc	cmd.exe
File opened for modification	C:\Windows\SysWOW64\en-US\searchfolder.dll.mui	cmd.exe
File opened for modification	C:\Windows\SysWOW64\fr-FR\Microsoft.Uev.AppAgent.dll.mui	cmd.exe
File opened for modification	C:\Windows\SysWOW64\ja-JP\wldap32.dll.mui	cmd.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BRANCH~1\BranchCacheOrchestrator.cdxml	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\de-DE\netelx.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\es-ES\sisraid4.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\es-ES\wpdmtphw.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\fusionv2.inf_amd64_a47d9636ce0d7dab\FusionV2.dll	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ialpss2i_i2c_skl.inf_amd64_9d9dbb01837eba23\iaLPSS2i_I2C_SKL.inf	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\ja-JP\DigitalMediaDevice.inf_loc	cmd.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en\powershell_ise.resources.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\CredProv2faHelper.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\de-DE\advpack.dll.mui	cmd.exe
File opened for modification	C:\Windows\SysWOW64\wbem\dimsjob.mof	cmd.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Security\Microsoft.PowerShell.Security.psd1	cmd.exe
File opened for modification	C:\Windows\SysWOW64\WinMetadata\Windows.Management.winmd	cmd.exe
File opened for modification	C:\Windows\SysWOW64\DaOtpCredentialProvider.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\rundll32.exe	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8609393373af63e6a6e230839ea95480_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2572	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2572	PING.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 5004 wrote to memory of 1192	5004	8609393373af63e6a6e230839ea95480_JaffaCakes118.exe	84
PID 5004 wrote to memory of 1192	5004	8609393373af63e6a6e230839ea95480_JaffaCakes118.exe	84
PID 5004 wrote to memory of 1192	5004	8609393373af63e6a6e230839ea95480_JaffaCakes118.exe	84
PID 1192 wrote to memory of 1600	1192	cmd.exe	85
PID 1192 wrote to memory of 1600	1192	cmd.exe	85
PID 1192 wrote to memory of 1600	1192	cmd.exe	85
PID 1600 wrote to memory of 1860	1600	cmd.exe	88
PID 1600 wrote to memory of 1860	1600	cmd.exe	88
PID 1600 wrote to memory of 1860	1600	cmd.exe	88
PID 1600 wrote to memory of 2572	1600	cmd.exe	90
PID 1600 wrote to memory of 2572	1600	cmd.exe	90
PID 1600 wrote to memory of 2572	1600	cmd.exe	90

C:\Users\Admin\AppData\Local\Temp\8609393373af63e6a6e230839ea95480_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8609393373af63e6a6e230839ea95480_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5004
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\\juden1.bat C:\Users\Admin\AppData\Local\Temp\8609393373af63e6a6e230839ea95480_JaffaCakes118.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1192
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\\juden1.bat C:\Users\Admin\AppData\Local\Temp\8609393373af63e6a6e230839ea95480_JaffaCakes118.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1600
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c rd /s /q C:
      4⤵
      Drops file in Drivers directory
      Manipulates Digital Signatures
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      PID:1860
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\juden1.bat

Filesize
4KB

MD5
d753730e104a5f9184f9d2df1e3faad7

SHA1
bf06316bb647ddfc13b07ef814eb6736fa0cf097

SHA256
c813f765d8667ef3e9de4949cf5c8f8a1e44654941cb507337aede6425801e4f

SHA512
c797e6244bb1e59217975b4c3ba3b6df397b82443d2a246c7d8b6916b06710cc443470aa500a9c12d7860d3d7d59195f8d15509f61279b4e3a17bbf4aea42b85

Download Submit
memory/5004-0-0x0000000000400000-0x000000000048A800-memory.dmp

Filesize
554KB

Download
memory/5004-1-0x0000000000490000-0x00000000004EC000-memory.dmp

Filesize
368KB

Download
memory/5004-4-0x0000000000800000-0x000000000082C000-memory.dmp

Filesize
176KB

Download
memory/5004-7-0x0000000000800000-0x000000000082C000-memory.dmp

Filesize
176KB

Download
memory/5004-6-0x0000000000400000-0x000000000048A800-memory.dmp

Filesize
554KB

Download