9966fc9a4ef85925a9500e325f8f371bbe74df367e8c25146f090c4ada940305

Analysis

max time kernel
140s
max time network
136s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
14/08/2024, 12:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

961dbc1aef8dc473ac367465075a4708_JaffaCakes118.exe
Size

75KB
MD5

961dbc1aef8dc473ac367465075a4708
SHA1

2da4ef5829b7fb71bfc1d4e7ae3a8bacda6b0f75
SHA256

9966fc9a4ef85925a9500e325f8f371bbe74df367e8c25146f090c4ada940305
SHA512

8dac7fcaaeb62bbb8a5a2b769a36978dde71aedde89c99e2102969485fea3debb8bdb0ed071273fb7a3568158025b85919340e1fe345ab84617bfae099d10e09
SSDEEP

1536:KzJ2W1Dy3qfHTGFq+/UbyyiVz9TwMWpo1rsiV5Spe9EC632B8mA6EZE6:KtbFy3qfH6Yc0r0xTwMWpoTV5SpLQ8x1

Score

8^/10

discovery persistence upx

Malware Config

Signatures

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\DNS\Parameters\ServiceDll = "C:\\Windows\\system32\\adsmt.dll"	961dbc1aef8dc473ac367465075a4708_JaffaCakes118.exe

Deletes itself 1 IoCs

pid	Process
2892	cmd.exe

Loads dropped DLL 2 IoCs

pid	Process
2724	961dbc1aef8dc473ac367465075a4708_JaffaCakes118.exe
2804	svchost.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00080000000120fd-2.dat	upx
behavioral1/memory/2724-4-0x0000000000230000-0x000000000025E000-memory.dmp	upx
behavioral1/memory/2804-12-0x00000000002E0000-0x000000000030E000-memory.dmp	upx
behavioral1/memory/2804-22-0x00000000002E0000-0x000000000030E000-memory.dmp	upx

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\adsmt.dll	961dbc1aef8dc473ac367465075a4708_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	svchost.exe
File created	C:\Windows\SysWOW64\adsmt.dll	961dbc1aef8dc473ac367465075a4708_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	961dbc1aef8dc473ac367465075a4708_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies data under HKEY_USERS 28 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\c2-1a-9c-06-72-ed\WpadDecisionTime = e014b10246eeda01	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00b1000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3672FCC5-B714-4182-93C1-9663ACBBD70B}\c2-1a-9c-06-72-ed	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\c2-1a-9c-06-72-ed\WpadDecisionReason = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00b1000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\c2-1a-9c-06-72-ed\WpadDecisionTime = 60e1c12c46eeda01	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3672FCC5-B714-4182-93C1-9663ACBBD70B}	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\c2-1a-9c-06-72-ed\WpadDecision = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3672FCC5-B714-4182-93C1-9663ACBBD70B}\WpadDecisionTime = 60e1c12c46eeda01	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3672FCC5-B714-4182-93C1-9663ACBBD70B}\WpadDecisionReason = "1"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3672FCC5-B714-4182-93C1-9663ACBBD70B}\WpadNetworkName = "Network 3"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\c2-1a-9c-06-72-ed\WpadDetectedUrl	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3672FCC5-B714-4182-93C1-9663ACBBD70B}\WpadDecisionTime = e014b10246eeda01	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3672FCC5-B714-4182-93C1-9663ACBBD70B}\WpadDecision = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\c2-1a-9c-06-72-ed	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2724	961dbc1aef8dc473ac367465075a4708_JaffaCakes118.exe
2804	svchost.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 2892	2724	961dbc1aef8dc473ac367465075a4708_JaffaCakes118.exe	31
PID 2724 wrote to memory of 2892	2724	961dbc1aef8dc473ac367465075a4708_JaffaCakes118.exe	31
PID 2724 wrote to memory of 2892	2724	961dbc1aef8dc473ac367465075a4708_JaffaCakes118.exe	31
PID 2724 wrote to memory of 2892	2724	961dbc1aef8dc473ac367465075a4708_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\961dbc1aef8dc473ac367465075a4708_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\961dbc1aef8dc473ac367465075a4708_JaffaCakes118.exe"
1⤵
- Server Software Component: Terminal Services DLL
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\259411940.bat" "
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2892

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k krnlsrvc
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\259411940.bat

Filesize
278B

MD5
d49dc4fde872455c68ead0b06b83233a

SHA1
71bba98ec1fcc02d0972ca95b419fc6e03e2333f

SHA256
74cbbb60f6ddf22f6397fa1aec5a0447142ae27c19f3491676d2c5a655ea2752

SHA512
4df3f5bb6d27eab3d6f684110376af51231eca57bb651de8d35ea012262f8473965021e474e2145ec489c0e16ff55a5aaf91d4914bbe0250dc593075f0c64694

Download Submit
\Users\Admin\AppData\Local\Temp\259411800.tmp

Filesize
64KB

MD5
acc7862b21e9815a0ab54fc499fb4038

SHA1
9aa275a7cbce473fafbf920934a7af70932c3c28

SHA256
31e4a30e02f48b23c90716f093050d45aeea3705ad18686ec60766e9dd5ddce1

SHA512
419a358344670e395d3702fd69171cdf0577d461f2a984dfd7fb6305b74be62b1bcbc6a9936dc2202ad3a112b3dd52ef953329394e9006adba2fb41f27777e73

Download Submit
memory/2724-1-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2724-4-0x0000000000230000-0x000000000025E000-memory.dmp

Filesize
184KB

Download
memory/2724-20-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2804-12-0x00000000002E0000-0x000000000030E000-memory.dmp

Filesize
184KB

Download
memory/2804-22-0x00000000002E0000-0x000000000030E000-memory.dmp

Filesize
184KB

Download