ccab3eca611825bb65950dd4f576c1587d046c95d0551851a07750f6f34bcf6d

Analysis

max time kernel
141s
max time network
89s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
10/08/2024, 14:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

867ea4dde1cbd5df03e7e27d794e72fa_JaffaCakes118.exe
Size

743KB
MD5

867ea4dde1cbd5df03e7e27d794e72fa
SHA1

46e7ee5478b43ef05540f79ffddd0d63422ad7fa
SHA256

ccab3eca611825bb65950dd4f576c1587d046c95d0551851a07750f6f34bcf6d
SHA512

8043d5412e97c4a264adcefb25f6244ab684f6119f078b346dee9697db04c7d2014664ead849c0e611f805b0516def82589ae1b22ee89831e2fa40d5c6c30184
SSDEEP

12288:gRn8S++U4u/n/80dW5A0zyo6JwQ5oAlK+GPHvZJIk6bQQ52LYRg08yPwDRPB:E8MU4ufxdW5A2mJr/kNHv/Ik633Y

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2664	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2316	Hacker.com.cn.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	Hacker.com.cn.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\61642520.BAT	867ea4dde1cbd5df03e7e27d794e72fa_JaffaCakes118.exe
File created	C:\Windows\Hacker.com.cn.exe	867ea4dde1cbd5df03e7e27d794e72fa_JaffaCakes118.exe
File opened for modification	C:\Windows\Hacker.com.cn.exe	867ea4dde1cbd5df03e7e27d794e72fa_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	867ea4dde1cbd5df03e7e27d794e72fa_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hacker.com.cn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies data under HKEY_USERS 28 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0A06E097-652D-4C39-9A88-75B6F918D44C}\WpadDecision = "0"	Hacker.com.cn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	Hacker.com.cn.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Hacker.com.cn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	Hacker.com.cn.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f007e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Hacker.com.cn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0A06E097-652D-4C39-9A88-75B6F918D44C}	Hacker.com.cn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\1e-e7-2b-a0-30-35\WpadDecisionReason = "1"	Hacker.com.cn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Hacker.com.cn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	Hacker.com.cn.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0A06E097-652D-4C39-9A88-75B6F918D44C}\WpadDecisionTime = 709db9f034ebda01	Hacker.com.cn.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	Hacker.com.cn.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	Hacker.com.cn.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Hacker.com.cn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	Hacker.com.cn.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0A06E097-652D-4C39-9A88-75B6F918D44C}\WpadNetworkName = "Network 3"	Hacker.com.cn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0A06E097-652D-4C39-9A88-75B6F918D44C}\1e-e7-2b-a0-30-35	Hacker.com.cn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\1e-e7-2b-a0-30-35\WpadDecision = "0"	Hacker.com.cn.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\1e-e7-2b-a0-30-35\WpadDetectedUrl	Hacker.com.cn.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\1e-e7-2b-a0-30-35\WpadDecisionTime = f094012235ebda01	Hacker.com.cn.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	Hacker.com.cn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\1e-e7-2b-a0-30-35	Hacker.com.cn.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\1e-e7-2b-a0-30-35\WpadDecisionTime = 709db9f034ebda01	Hacker.com.cn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	Hacker.com.cn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	Hacker.com.cn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0A06E097-652D-4C39-9A88-75B6F918D44C}\WpadDecisionReason = "1"	Hacker.com.cn.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	Hacker.com.cn.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f007e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Hacker.com.cn.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0A06E097-652D-4C39-9A88-75B6F918D44C}\WpadDecisionTime = f094012235ebda01	Hacker.com.cn.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1020	867ea4dde1cbd5df03e7e27d794e72fa_JaffaCakes118.exe
Token: SeDebugPrivilege	2316	Hacker.com.cn.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2316	Hacker.com.cn.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1020 wrote to memory of 2664	1020	867ea4dde1cbd5df03e7e27d794e72fa_JaffaCakes118.exe	31
PID 1020 wrote to memory of 2664	1020	867ea4dde1cbd5df03e7e27d794e72fa_JaffaCakes118.exe	31
PID 1020 wrote to memory of 2664	1020	867ea4dde1cbd5df03e7e27d794e72fa_JaffaCakes118.exe	31
PID 1020 wrote to memory of 2664	1020	867ea4dde1cbd5df03e7e27d794e72fa_JaffaCakes118.exe	31
PID 2316 wrote to memory of 2508	2316	Hacker.com.cn.exe	30
PID 2316 wrote to memory of 2508	2316	Hacker.com.cn.exe	30
PID 2316 wrote to memory of 2508	2316	Hacker.com.cn.exe	30
PID 2316 wrote to memory of 2508	2316	Hacker.com.cn.exe	30

C:\Users\Admin\AppData\Local\Temp\867ea4dde1cbd5df03e7e27d794e72fa_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\867ea4dde1cbd5df03e7e27d794e72fa_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1020
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\61642520.BAT
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2664

C:\Windows\Hacker.com.cn.exe
C:\Windows\Hacker.com.cn.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:2508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\61642520.BAT

Filesize
218B

MD5
6ce63cc43fd6909f46883453d79b8af4

SHA1
08c164554d6acb1b080d536121f263b7fcaee69f

SHA256
cb4c272430675d6017e084f639a6cc4cf24a87f535bed3bb306a0af963cff138

SHA512
718e02aa499a6df55b84b7720aa2d7e9fd3f735d3bb29a54ddc73d3161be5d9fdac1325f4a9c2651421dad68c4aeaf35c8a80b7e8127e4e97c328c0ef5a8633e

Download Submit
C:\Windows\Hacker.com.cn.exe

Filesize
743KB

MD5
867ea4dde1cbd5df03e7e27d794e72fa

SHA1
46e7ee5478b43ef05540f79ffddd0d63422ad7fa

SHA256
ccab3eca611825bb65950dd4f576c1587d046c95d0551851a07750f6f34bcf6d

SHA512
8043d5412e97c4a264adcefb25f6244ab684f6119f078b346dee9697db04c7d2014664ead849c0e611f805b0516def82589ae1b22ee89831e2fa40d5c6c30184

Download Submit
memory/1020-0-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/1020-13-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/2316-12-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2316-15-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/2316-17-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2316-20-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download