99d3ae5694fb2a00600caa7a529bd370bedf088f83d49c8d8dfd133077359af7

Analysis

max time kernel
49s
max time network
49s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
14-08-2024 08:44

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe
Size

30KB
MD5

956044ce35d3308d51cf4080100a3386
SHA1

4c4a00844be543b7a1054e1207476ad4f48ffbdb
SHA256

99d3ae5694fb2a00600caa7a529bd370bedf088f83d49c8d8dfd133077359af7
SHA512

3fd5faf906b66ab6344d1cbd5d409082aa3343296636e580b32dd9f29df8c88e9dd88a2c98826c3e6907618e31abb4992712acd30ad1b93a8ba6cd566074caa1
SSDEEP

768:KR6ssqyTrtz0pb5O0Z5bDbnxvwrwxsSGWlliIicQ:KertYO0Z1V3jGWllo

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/556-0-0x0000000000400000-0x0000000000419000-memory.dmp	upx
behavioral1/memory/556-1-0x0000000000400000-0x0000000000419000-memory.dmp	upx
behavioral1/memory/556-3-0x0000000000400000-0x0000000000419000-memory.dmp	upx
behavioral1/memory/556-15-0x0000000000400000-0x0000000000419000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2624	556	WerFault.exe	29

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
556	956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe
556	956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe
556	956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe
556	956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe
556	956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe
556	956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe
556	956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe
556	956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe
556	956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe
556	956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe
556	956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe
556	956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe
556	956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe
556	956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe
556	956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe
556	956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe
556	956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe
556	956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe
556	956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe
556	956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe
556	956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe
556	956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe
556	956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe
556	956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe
556	956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe
556	956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe
556	956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe
556	956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe
556	956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe
556	956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe
556	956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe
556	956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe
556	956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe
556	956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe
556	956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe
556	956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe
556	956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe
556	956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe
556	956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe
556	956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe
556	956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe
556	956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe
556	956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe
556	956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe
556	956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe
556	956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe
556	956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe
556	956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe
556	956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe
556	956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe
556	956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe
556	956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe
556	956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe
556	956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe
556	956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe
556	956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe
556	956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe
556	956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe
556	956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe
556	956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe
556	956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe
556	956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe
556	956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe
556	956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	556	956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 556 wrote to memory of 2744	556	956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe	32
PID 556 wrote to memory of 2744	556	956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe	32
PID 556 wrote to memory of 2744	556	956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe	32
PID 556 wrote to memory of 2744	556	956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe	32
PID 556 wrote to memory of 2624	556	956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe	35
PID 556 wrote to memory of 2624	556	956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe	35
PID 556 wrote to memory of 2624	556	956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe	35
PID 556 wrote to memory of 2624	556	956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe	35

C:\Users\Admin\AppData\Local\Temp\956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\956044ce35d3308d51cf4080100a3386_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:556
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows9x.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2744
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 556 -s 808
  2⤵
  - Program crash
  PID:2624

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:2616

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:1292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\windows9x.bat

Filesize
232B

MD5
f0bf6fd0018f073c294f6c013e7d11ac

SHA1
7f9e3accaa4520d5882145e48d00ac275cbb12a8

SHA256
0718929da107997a16b9a99389fb63c539ab6e30a69e54828fb0d002ea53206b

SHA512
89b9cf4df80bc180f98afaae3ad20d2d16975a1035cd80a37e3a5c529cc2288b1794221e687b2d366a57def4b7f578daf780f2eff6ed96788b097293854a7d14

Download Submit
memory/556-0-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/556-1-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/556-3-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/556-15-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1292-16-0x0000000002AB0000-0x0000000002AB1000-memory.dmp

Filesize
4KB

Download
memory/2616-13-0x0000000002E10000-0x0000000002E11000-memory.dmp

Filesize
4KB

Download