36b36af7a1bb9dac92c33ce73545b2d6b7991147669d8ee52be41a4292fb062d

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
14/08/2024, 11:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9602303e09b6d71564f1c7f2798bcefb_JaffaCakes118.exe
Size

44KB
MD5

9602303e09b6d71564f1c7f2798bcefb
SHA1

1465dfd3d0b6d2fd1026d427fdd771f7cc5baf5d
SHA256

36b36af7a1bb9dac92c33ce73545b2d6b7991147669d8ee52be41a4292fb062d
SHA512

86e40951ebf499a4f7ae3372b18b4f2c08e528b726cd3ff940caf0f7804343a23ad17ae54dc320b780deb3153cb726b1123ffc14995d6f86d0f74ac7e39931b9
SSDEEP

768:hConZrk9TA9n8MLJajJN6tVqqBLWKg/S7yHTOfWzL8zF21IFPfpTrZNXohVR:YoeAeMokNe/S7bfWqF/BhTdNXa

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\skswall.sys	skswall.exe

Executes dropped EXE 2 IoCs

pid	Process
2968	opeF824.exe
2760	skswall.exe

Loads dropped DLL 2 IoCs

pid	Process
1932	9602303e09b6d71564f1c7f2798bcefb_JaffaCakes118.exe
1932	9602303e09b6d71564f1c7f2798bcefb_JaffaCakes118.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	skswall.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\skswall\skswall.exe	opeF824.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2704	2760	WerFault.exe	32

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	opeF824.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skswall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9602303e09b6d71564f1c7f2798bcefb_JaffaCakes118.exe

Modifies data under HKEY_USERS 39 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\System	skswall.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	skswall.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a6-03-51-b6-45-0a\WpadDecisionReason = "1"	skswall.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet	skswall.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control	skswall.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm\wheel = "1"	skswall.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	skswall.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FB0602B5-1DB9-48E8-93B1-B509B67AD4AE}\WpadNetworkName = "Network 3"	skswall.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	skswall.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties	skswall.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	skswall.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	skswall.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FB0602B5-1DB9-48E8-93B1-B509B67AD4AE}\WpadDecisionReason = "1"	skswall.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a6-03-51-b6-45-0a\WpadDecision = "0"	skswall.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	skswall.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Multimedia\DrawDib\ 1024x768x32(BGR 0) = "31,31,31,31"	skswall.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm	skswall.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties	skswall.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick	skswall.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	skswall.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FB0602B5-1DB9-48E8-93B1-B509B67AD4AE}	skswall.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FB0602B5-1DB9-48E8-93B1-B509B67AD4AE}\WpadDecisionTime = d02ce43541eeda01	skswall.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FB0602B5-1DB9-48E8-93B1-B509B67AD4AE}\a6-03-51-b6-45-0a	skswall.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	skswall.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm	skswall.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	skswall.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Multimedia	skswall.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	skswall.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	skswall.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	skswall.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	skswall.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\DrawDib	skswall.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	skswall.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Multimedia\DrawDib	skswall.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	skswall.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FB0602B5-1DB9-48E8-93B1-B509B67AD4AE}\WpadDecision = "0"	skswall.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a6-03-51-b6-45-0a	skswall.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a6-03-51-b6-45-0a\WpadDecisionTime = d02ce43541eeda01	skswall.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	skswall.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
464	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2968	opeF824.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 2968	1932	9602303e09b6d71564f1c7f2798bcefb_JaffaCakes118.exe	31
PID 1932 wrote to memory of 2968	1932	9602303e09b6d71564f1c7f2798bcefb_JaffaCakes118.exe	31
PID 1932 wrote to memory of 2968	1932	9602303e09b6d71564f1c7f2798bcefb_JaffaCakes118.exe	31
PID 1932 wrote to memory of 2968	1932	9602303e09b6d71564f1c7f2798bcefb_JaffaCakes118.exe	31
PID 2968 wrote to memory of 2652	2968	opeF824.exe	33
PID 2968 wrote to memory of 2652	2968	opeF824.exe	33
PID 2968 wrote to memory of 2652	2968	opeF824.exe	33
PID 2968 wrote to memory of 2652	2968	opeF824.exe	33
PID 2760 wrote to memory of 2704	2760	skswall.exe	34
PID 2760 wrote to memory of 2704	2760	skswall.exe	34
PID 2760 wrote to memory of 2704	2760	skswall.exe	34
PID 2760 wrote to memory of 2704	2760	skswall.exe	34

C:\Users\Admin\AppData\Local\Temp\9602303e09b6d71564f1c7f2798bcefb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9602303e09b6d71564f1c7f2798bcefb_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Users\Admin\AppData\Local\Temp\opeF824.exe
  "C:\Users\Admin\AppData\Local\Temp\opeF824.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2968
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\opeF824.exe > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2652

C:\Windows\skswall\skswall.exe
C:\Windows\skswall\skswall.exe
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2760 -s 744
  2⤵
  - Program crash
  PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\skswall\skswall.exe

Filesize
45KB

MD5
9d6f008959289c199d7f187a1a5aeba3

SHA1
3e0fa6ec1c7dfb829a15cdcd03ddd3fe77952fc6

SHA256
92e8627a15d348d2f5e87dcd1a7b4ea711c1b29c3851a74389c547eb516b55e9

SHA512
7c0dd246f113eb8ef033fa4483a70083fc329e7869318699ab1b9ecd733d0b7574fc2851674114bca7a2b183a61d00ba5bc72a665dcb15096cbe821b8fd86a34

Download Submit
\Users\Admin\AppData\Local\Temp\opeF824.exe

Filesize
45KB

MD5
43c73ea2871d383664fb447954b7135b

SHA1
0ca93d8223037e42243389ac2fd52b16c5eb4b8e

SHA256
4cdd50d85d79c65e2b812308eae3e5204c5e99ffe66bf019d5409b93ed032d13

SHA512
7b93c3b110aed515f571228edb6923b0c80b89698fb14dc4f53327424e0db3db765b657f191f22385c0a824980c81cdf17aed4e46b6adde8c09d82f54c2581f1

Download Submit
memory/1932-0-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1932-10-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2760-16-0x0000000000400000-0x0000000002CC5000-memory.dmp

Filesize
40.8MB

Download
memory/2968-14-0x0000000000400000-0x0000000002CC5000-memory.dmp

Filesize
40.8MB

Download