de932dfeffdc704b1e945b00c74792130b9c08c347ccfecf86824e7f8669be0d

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
11/08/2024, 23:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8c63e0940ad716bc2a82d6f8e034bc07_JaffaCakes118.exe
Size 110KB
Sample240811-3cm85stfmp
SHA256 de932dfeffdc704b1e945b00c74792130b9c08c347ccfecf86824e7f8669be0d
MD5 8c63e0940ad716bc2a82d6f8e034bc07
SHA1 939ce6ddff6f6fc179ca287b5ef538648db656cb
SHA512 d2d1701e6ad2919272e8dfa71cfc86e7660c6406c8bee3e8d0651ca76f5e75ff4b50b8de1b441a5e4e7dfd98f89a91bfbea8b7cf51a8aa02e9fbc58d337af800
SSDEEP 1536:3zQMWNQtkYj5Yc19lJnS5dByNLcM2qihl9VlCAhHCtRHPq2:36ut+c1XJSHByN4kihl99hit
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

defense_evasion discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
2544	takeown.exe
1644	icacls.exe

Deletes itself 1 IoCs

pid	Process
2300	regsvr32.exe

Loads dropped DLL 1 IoCs

pid	Process
2300	regsvr32.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2544	takeown.exe
1644	icacls.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\apa.dll	regsvr32.exe
File created	C:\Windows\SysWOW64\rpcss.dll	regsvr32.exe
File opened for modification	C:\Windows\SysWOW64\rpcss.dll	regsvr32.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8c63e0940ad716bc2a82d6f8e034bc07_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2300	regsvr32.exe
2300	regsvr32.exe
2300	regsvr32.exe
2300	regsvr32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2300	regsvr32.exe
Token: SeTakeOwnershipPrivilege	2544	takeown.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 2584 wrote to memory of 2300	2584	8c63e0940ad716bc2a82d6f8e034bc07_JaffaCakes118.exe	30
PID 2584 wrote to memory of 2300	2584	8c63e0940ad716bc2a82d6f8e034bc07_JaffaCakes118.exe	30
PID 2584 wrote to memory of 2300	2584	8c63e0940ad716bc2a82d6f8e034bc07_JaffaCakes118.exe	30
PID 2584 wrote to memory of 2300	2584	8c63e0940ad716bc2a82d6f8e034bc07_JaffaCakes118.exe	30
PID 2584 wrote to memory of 2300	2584	8c63e0940ad716bc2a82d6f8e034bc07_JaffaCakes118.exe	30
PID 2584 wrote to memory of 2300	2584	8c63e0940ad716bc2a82d6f8e034bc07_JaffaCakes118.exe	30
PID 2584 wrote to memory of 2300	2584	8c63e0940ad716bc2a82d6f8e034bc07_JaffaCakes118.exe	30
PID 2300 wrote to memory of 2544	2300	regsvr32.exe	31
PID 2300 wrote to memory of 2544	2300	regsvr32.exe	31
PID 2300 wrote to memory of 2544	2300	regsvr32.exe	31
PID 2300 wrote to memory of 2544	2300	regsvr32.exe	31
PID 2300 wrote to memory of 1644	2300	regsvr32.exe	33
PID 2300 wrote to memory of 1644	2300	regsvr32.exe	33
PID 2300 wrote to memory of 1644	2300	regsvr32.exe	33
PID 2300 wrote to memory of 1644	2300	regsvr32.exe	33
PID 2300 wrote to memory of 596	2300	regsvr32.exe	9
PID 2300 wrote to memory of 596	2300	regsvr32.exe	9
PID 2300 wrote to memory of 672	2300	regsvr32.exe	10
PID 2300 wrote to memory of 672	2300	regsvr32.exe	10
PID 2300 wrote to memory of 740	2300	regsvr32.exe	11
PID 2300 wrote to memory of 740	2300	regsvr32.exe	11
PID 2300 wrote to memory of 816	2300	regsvr32.exe	12
PID 2300 wrote to memory of 816	2300	regsvr32.exe	12
PID 2300 wrote to memory of 852	2300	regsvr32.exe	13
PID 2300 wrote to memory of 852	2300	regsvr32.exe	13
PID 2300 wrote to memory of 972	2300	regsvr32.exe	15
PID 2300 wrote to memory of 972	2300	regsvr32.exe	15
PID 2300 wrote to memory of 296	2300	regsvr32.exe	16
PID 2300 wrote to memory of 296	2300	regsvr32.exe	16
PID 2300 wrote to memory of 1128	2300	regsvr32.exe	19
PID 2300 wrote to memory of 1128	2300	regsvr32.exe	19
PID 2300 wrote to memory of 2308	2300	regsvr32.exe	26
PID 2300 wrote to memory of 2308	2300	regsvr32.exe	26
PID 2300 wrote to memory of 2148	2300	regsvr32.exe	35
PID 2300 wrote to memory of 2148	2300	regsvr32.exe	35
PID 2300 wrote to memory of 2148	2300	regsvr32.exe	35
PID 2300 wrote to memory of 2148	2300	regsvr32.exe	35

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
1⤵
PID:596

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS
1⤵
PID:672

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:740

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
1⤵
PID:816

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
1⤵
PID:852

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService
1⤵
PID:972

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService
1⤵
PID:296

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
1⤵
PID:1128

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
1⤵
PID:2308

C:\Users\Admin\AppData\Local\Temp\8c63e0940ad716bc2a82d6f8e034bc07_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8c63e0940ad716bc2a82d6f8e034bc07_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\system32\regsvr32.exe" /s C:\Users\Admin\AppData\Local\Temp\~~f76b2ac.tmp ,C:\Users\Admin\AppData\Local\Temp\8c63e0940ad716bc2a82d6f8e034bc07_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2300
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f "C:\Windows\system32\rpcss.dll"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2544
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Windows\system32\rpcss.dll" /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:1644
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c del %%SystemRoot%%\system32\rpcss.dll~*
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

~~f76b2ac.tmp

Path C:\Users\Admin\AppData\Local\Temp\~~f76b2ac.tmp
Size 1.0MB
SHA256 27eeca39a445b0e0bcb6067a3fbb55a45963f29b84977a1987e64a7240045327
MD5 500fc03795264aedebfa2f366e184b28
SHA1 f9d688da4a491223ab5dab1181f9c6290e3039ee
SHA512 03060c034c82f850cabfad3956be13fbaee7f4bb3583c13357bc9733218777cb29a4099bccf498457627515ef3b82da6eb300850a6bf0f5c3727411195caf5d6
SSDEEP 3072:RfAUpyWZ/hBZHpzOB64j13x970TKWVXNCxH:xAEfZ7S4M1B970TKmNCN
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/596-12-0x0000000000460000-0x0000000000461000-memory.dmp

Download