16a218b2fb0cb4da6ee9b2592c9f59c2bb25ee200c4c53ac6a0d2da0d4c78f18

Analysis

max time kernel
17s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
16/08/2024, 23:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a0649dc2ece53fcdf74d08e23a958de0_JaffaCakes118.exe
Size 955KB
Sample240816-3lsj8avakf
SHA256 16a218b2fb0cb4da6ee9b2592c9f59c2bb25ee200c4c53ac6a0d2da0d4c78f18
MD5 a0649dc2ece53fcdf74d08e23a958de0
SHA1 69755575602dde242858cd638fa42059b4cd74f5
SHA512 5031d05dfd7469bce2cc6516d92541c9ccf37955c48d251e4ed7a02bf8102ee454608d4418a41c3468dc8c6bb0b2fd4b2122488c377a98b1001bf32da7aa7832
SSDEEP 24576:5g85BnlX8VAAtZp43u+sNH8az/g/J/NQ:aBtZp3H8aP
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

discovery evasion execution vmprotect

Malware Config

Signatures

Disables service(s) 3 TTPs
evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\acpiec.sys	a0649dc2ece53fcdf74d08e23a958de0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\pcidump.sys	a0649dc2ece53fcdf74d08e23a958de0_JaffaCakes118.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	a0649dc2ece53fcdf74d08e23a958de0_JaffaCakes118.exe

Loads dropped DLL 2 IoCs

pid	Process
4612	rundll32.exe
3016	a0649dc2ece53fcdf74d08e23a958de0_JaffaCakes118.exe

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/memory/3016-0-0x0000000000400000-0x0000000000432000-memory.dmp	vmprotect
behavioral2/memory/3016-15-0x0000000000400000-0x0000000000432000-memory.dmp	vmprotect

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	C:\autorun.inf	a0649dc2ece53fcdf74d08e23a958de0_JaffaCakes118.exe
File opened for modification	C:\autorun.inf	a0649dc2ece53fcdf74d08e23a958de0_JaffaCakes118.exe
File created	F:\autorun.inf	a0649dc2ece53fcdf74d08e23a958de0_JaffaCakes118.exe
File opened for modification	F:\autorun.inf	a0649dc2ece53fcdf74d08e23a958de0_JaffaCakes118.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\a18467stva41a.dll	a0649dc2ece53fcdf74d08e23a958de0_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\def26500aab6334ccd.dll	a0649dc2ece53fcdf74d08e23a958de0_JaffaCakes118.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2888	sc.exe
4588	sc.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3384	4612	WerFault.exe	104

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a0649dc2ece53fcdf74d08e23a958de0_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1332	ipconfig.exe

Kills process with taskkill 4 IoCs

evasion

pid	Process
4120	taskkill.exe
1288	taskkill.exe
4372	taskkill.exe
4432	taskkill.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3016	a0649dc2ece53fcdf74d08e23a958de0_JaffaCakes118.exe
3016	a0649dc2ece53fcdf74d08e23a958de0_JaffaCakes118.exe
3016	a0649dc2ece53fcdf74d08e23a958de0_JaffaCakes118.exe
3016	a0649dc2ece53fcdf74d08e23a958de0_JaffaCakes118.exe
3016	a0649dc2ece53fcdf74d08e23a958de0_JaffaCakes118.exe
3016	a0649dc2ece53fcdf74d08e23a958de0_JaffaCakes118.exe
4612	rundll32.exe
4612	rundll32.exe
4612	rundll32.exe
4612	rundll32.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	4432	taskkill.exe
Token: SeDebugPrivilege	1288	taskkill.exe
Token: SeDebugPrivilege	4372	taskkill.exe
Token: SeDebugPrivilege	4120	taskkill.exe
Token: SeDebugPrivilege	4612	rundll32.exe
Token: SeDebugPrivilege	4612	rundll32.exe
Token: SeDebugPrivilege	4612	rundll32.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 2888	3016	a0649dc2ece53fcdf74d08e23a958de0_JaffaCakes118.exe	86
PID 3016 wrote to memory of 2888	3016	a0649dc2ece53fcdf74d08e23a958de0_JaffaCakes118.exe	86
PID 3016 wrote to memory of 2888	3016	a0649dc2ece53fcdf74d08e23a958de0_JaffaCakes118.exe	86
PID 3016 wrote to memory of 4588	3016	a0649dc2ece53fcdf74d08e23a958de0_JaffaCakes118.exe	87
PID 3016 wrote to memory of 4588	3016	a0649dc2ece53fcdf74d08e23a958de0_JaffaCakes118.exe	87
PID 3016 wrote to memory of 4588	3016	a0649dc2ece53fcdf74d08e23a958de0_JaffaCakes118.exe	87
PID 3016 wrote to memory of 4120	3016	a0649dc2ece53fcdf74d08e23a958de0_JaffaCakes118.exe	88
PID 3016 wrote to memory of 4120	3016	a0649dc2ece53fcdf74d08e23a958de0_JaffaCakes118.exe	88
PID 3016 wrote to memory of 4120	3016	a0649dc2ece53fcdf74d08e23a958de0_JaffaCakes118.exe	88
PID 3016 wrote to memory of 4432	3016	a0649dc2ece53fcdf74d08e23a958de0_JaffaCakes118.exe	89
PID 3016 wrote to memory of 4432	3016	a0649dc2ece53fcdf74d08e23a958de0_JaffaCakes118.exe	89
PID 3016 wrote to memory of 4432	3016	a0649dc2ece53fcdf74d08e23a958de0_JaffaCakes118.exe	89
PID 3016 wrote to memory of 4372	3016	a0649dc2ece53fcdf74d08e23a958de0_JaffaCakes118.exe	90
PID 3016 wrote to memory of 4372	3016	a0649dc2ece53fcdf74d08e23a958de0_JaffaCakes118.exe	90
PID 3016 wrote to memory of 4372	3016	a0649dc2ece53fcdf74d08e23a958de0_JaffaCakes118.exe	90
PID 3016 wrote to memory of 1288	3016	a0649dc2ece53fcdf74d08e23a958de0_JaffaCakes118.exe	91
PID 3016 wrote to memory of 1288	3016	a0649dc2ece53fcdf74d08e23a958de0_JaffaCakes118.exe	91
PID 3016 wrote to memory of 1288	3016	a0649dc2ece53fcdf74d08e23a958de0_JaffaCakes118.exe	91
PID 3016 wrote to memory of 2240	3016	a0649dc2ece53fcdf74d08e23a958de0_JaffaCakes118.exe	92
PID 3016 wrote to memory of 2240	3016	a0649dc2ece53fcdf74d08e23a958de0_JaffaCakes118.exe	92
PID 3016 wrote to memory of 2240	3016	a0649dc2ece53fcdf74d08e23a958de0_JaffaCakes118.exe	92
PID 3016 wrote to memory of 4612	3016	a0649dc2ece53fcdf74d08e23a958de0_JaffaCakes118.exe	104
PID 3016 wrote to memory of 4612	3016	a0649dc2ece53fcdf74d08e23a958de0_JaffaCakes118.exe	104
PID 3016 wrote to memory of 4612	3016	a0649dc2ece53fcdf74d08e23a958de0_JaffaCakes118.exe	104
PID 3016 wrote to memory of 1332	3016	a0649dc2ece53fcdf74d08e23a958de0_JaffaCakes118.exe	108
PID 3016 wrote to memory of 1332	3016	a0649dc2ece53fcdf74d08e23a958de0_JaffaCakes118.exe	108
PID 3016 wrote to memory of 1332	3016	a0649dc2ece53fcdf74d08e23a958de0_JaffaCakes118.exe	108

C:\Users\Admin\AppData\Local\Temp\a0649dc2ece53fcdf74d08e23a958de0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a0649dc2ece53fcdf74d08e23a958de0_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Windows\SysWOW64\sc.exe
  sc config ekrn start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2888
- C:\Windows\SysWOW64\sc.exe
  sc config rsravmon start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:4588
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /im ekrn.exe /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4120
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /im egui.exe /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4432
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /im 360sd.exe /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4372
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /im 360sd_se.exe /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1288
- C:\Windows\SysWOW64\cacls.exe
  cacls C:\Users\Admin\AppData\Local\Temp\ /e /p everyone:f cacls "C:\Windows" /e /p everyone:f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2240
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Windows\system32\a18467stva41a.dll, droqp
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4612
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4612 -s 668
    3⤵
    - Program crash
    PID:3384
- C:\Windows\SysWOW64\ipconfig.exe
  ipconfig /all
  2⤵
  - System Location Discovery: System Language Discovery
  - Gathers network information
  PID:1332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 4612 -ip 4612
1⤵
PID:2404

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:4420
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  PID:968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Command and Scripting Interpreter

T1059

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

a18467stva41a.dll

Path C:\Windows\SysWOW64\a18467stva41a.dll
Size 9KB
SHA256 56850456721c2cacd7040f08e0f86b278423a9a3264cf4d4971d186b991db713
MD5 c33c88aa771dd3a019608c0dfe47bdb2
SHA1 94f5b9d14bc7506dce737ceb7db192942d311907
SHA512 c9a9327c69e3fa2a133aece1d2b9873f21986207946690b98f91f528bdd0867026467a9bc286d509f27c13ba6c5efd3df128df2925cfa037bb0496adbb24bfb6
SSDEEP 96:28dg+AzPcmxDTonUR9/FNnHGSkJznoZE3DekK19eKE6fW90fHBJ:28++ATvnonUPHnHkoqykK7jbKIH
MD5 SHA1 SHA512 SSDEEP

Submit Download

def26500aab6334ccd.dll

Path C:\Windows\def26500aab6334ccd.dll
Size 44KB
SHA256 4a8257bd0fa7157117f6fb5fcc1a5fb94aca90fa785dd7a95a88971860f28e8d
MD5 9ceb1ff4d7ac4a349b0d60add542b406
SHA1 c3d7f9e23695fcd39ff58ec3af3bb8145596cfe5
SHA512 5fa800fd3d4371b306e849b230d85a1843969b52d7c76d1dbbe48aa28ed67d71dfc8c6b6782ab8c88a7356752f04cd5e1471ad580eb2a1bec377046a96e46333
SSDEEP 768:WxKjgOeDVYdzBclGvb+8e8n/qw2f34fevZNq0litzYS7JF:qDVyzBclGvbvAlf34Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3016-0-0x0000000000400000-0x0000000000432000-memory.dmp

Download

memory/3016-15-0x0000000000400000-0x0000000000432000-memory.dmp

Download

memory/3016-17-0x00000000766B0000-0x000000007672B000-memory.dmp

Download