c97a52af30e16ea87671ec0e13f5272627d140ba8f52592425f86edfac887465

Analysis

max time kernel
150s
max time network
118s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
17/08/2024, 02:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a0e7f4b932dd8d1f25aa40ddb5993952_JaffaCakes118.exe
Size

484KB
MD5

a0e7f4b932dd8d1f25aa40ddb5993952
SHA1

8a18ebdaea81a9761b19c5f97b09ac320bbf97a4
SHA256

c97a52af30e16ea87671ec0e13f5272627d140ba8f52592425f86edfac887465
SHA512

e91d1b03ddb7d07cfb559b06539afafc403ce3538c10ccc9d03255129e03e94631c404411a616a7e4aa9ff61a91145bd28cb96fa35db9e83e5e4aaa33bb11461
SSDEEP

12288:jUp4kk3oIXjZGhPtnZoGTTAA4fpKrwOJCgrOyMfI+In0:Y4JoIMhPtnr4A4B0cgrOyL0

Score

7^/10

discovery persistence upx

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
2372	scvhost.exe
2752	msnmgsr.exe
1004	scvhost.exe
448	msnmgsr.exe

Loads dropped DLL 4 IoCs

pid	Process
2968	a0e7f4b932dd8d1f25aa40ddb5993952_JaffaCakes118.exe
2372	scvhost.exe
2752	msnmgsr.exe
1004	scvhost.exe

UPX packed file 27 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2968-0-0x0000000000400000-0x0000000000498000-memory.dmp	upx
behavioral1/files/0x0009000000015e21-8.dat	upx
behavioral1/memory/2968-12-0x0000000000400000-0x0000000000498000-memory.dmp	upx
behavioral1/memory/2372-13-0x0000000000400000-0x0000000000498000-memory.dmp	upx
behavioral1/memory/2372-26-0x00000000038D0000-0x0000000003968000-memory.dmp	upx
behavioral1/memory/2372-63-0x0000000000400000-0x0000000000498000-memory.dmp	upx
behavioral1/memory/2752-66-0x0000000000400000-0x0000000000498000-memory.dmp	upx
behavioral1/memory/2752-67-0x0000000000400000-0x0000000000498000-memory.dmp	upx
behavioral1/memory/2752-69-0x0000000000400000-0x0000000000498000-memory.dmp	upx
behavioral1/memory/2372-70-0x0000000000400000-0x0000000000498000-memory.dmp	upx
behavioral1/memory/2752-71-0x0000000000400000-0x0000000000498000-memory.dmp	upx
behavioral1/memory/2752-73-0x0000000000400000-0x0000000000498000-memory.dmp	upx
behavioral1/memory/2752-75-0x0000000000400000-0x0000000000498000-memory.dmp	upx
behavioral1/memory/2752-77-0x0000000000400000-0x0000000000498000-memory.dmp	upx
behavioral1/memory/2752-79-0x0000000000400000-0x0000000000498000-memory.dmp	upx
behavioral1/memory/2752-81-0x0000000000400000-0x0000000000498000-memory.dmp	upx
behavioral1/memory/2372-82-0x0000000000400000-0x0000000000498000-memory.dmp	upx
behavioral1/memory/448-88-0x0000000000400000-0x0000000000498000-memory.dmp	upx
behavioral1/memory/448-90-0x0000000000400000-0x0000000000498000-memory.dmp	upx
behavioral1/memory/2752-91-0x0000000000400000-0x0000000000498000-memory.dmp	upx
behavioral1/memory/1004-92-0x0000000000400000-0x0000000000498000-memory.dmp	upx
behavioral1/memory/2752-95-0x0000000000400000-0x0000000000498000-memory.dmp	upx
behavioral1/memory/2752-97-0x0000000000400000-0x0000000000498000-memory.dmp	upx
behavioral1/memory/1004-98-0x0000000000400000-0x0000000000498000-memory.dmp	upx
behavioral1/memory/2752-99-0x0000000000400000-0x0000000000498000-memory.dmp	upx
behavioral1/memory/2752-101-0x0000000000400000-0x0000000000498000-memory.dmp	upx
behavioral1/memory/2752-103-0x0000000000400000-0x0000000000498000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSWINSCK.OCX = "C:\\Windows\\system32\\1035\\scvhost.exe"	msnmgsr.exe

AutoIT Executable 27 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/2968-12-0x0000000000400000-0x0000000000498000-memory.dmp	autoit_exe
behavioral1/memory/2372-13-0x0000000000400000-0x0000000000498000-memory.dmp	autoit_exe
behavioral1/memory/2372-26-0x00000000038D0000-0x0000000003968000-memory.dmp	autoit_exe
behavioral1/memory/2372-63-0x0000000000400000-0x0000000000498000-memory.dmp	autoit_exe
behavioral1/memory/2752-66-0x0000000000400000-0x0000000000498000-memory.dmp	autoit_exe
behavioral1/memory/2752-67-0x0000000000400000-0x0000000000498000-memory.dmp	autoit_exe
behavioral1/memory/2752-69-0x0000000000400000-0x0000000000498000-memory.dmp	autoit_exe
behavioral1/memory/2372-70-0x0000000000400000-0x0000000000498000-memory.dmp	autoit_exe
behavioral1/memory/2752-71-0x0000000000400000-0x0000000000498000-memory.dmp	autoit_exe
behavioral1/memory/2752-73-0x0000000000400000-0x0000000000498000-memory.dmp	autoit_exe
behavioral1/memory/2752-75-0x0000000000400000-0x0000000000498000-memory.dmp	autoit_exe
behavioral1/memory/2752-77-0x0000000000400000-0x0000000000498000-memory.dmp	autoit_exe
behavioral1/memory/2752-79-0x0000000000400000-0x0000000000498000-memory.dmp	autoit_exe
behavioral1/memory/2752-81-0x0000000000400000-0x0000000000498000-memory.dmp	autoit_exe
behavioral1/memory/2372-82-0x0000000000400000-0x0000000000498000-memory.dmp	autoit_exe
behavioral1/memory/448-88-0x0000000000400000-0x0000000000498000-memory.dmp	autoit_exe
behavioral1/memory/1004-86-0x0000000003940000-0x00000000039D8000-memory.dmp	autoit_exe
behavioral1/memory/448-90-0x0000000000400000-0x0000000000498000-memory.dmp	autoit_exe
behavioral1/memory/2752-91-0x0000000000400000-0x0000000000498000-memory.dmp	autoit_exe
behavioral1/memory/1004-92-0x0000000000400000-0x0000000000498000-memory.dmp	autoit_exe
behavioral1/memory/1004-93-0x0000000003940000-0x00000000039D8000-memory.dmp	autoit_exe
behavioral1/memory/2752-95-0x0000000000400000-0x0000000000498000-memory.dmp	autoit_exe
behavioral1/memory/2752-97-0x0000000000400000-0x0000000000498000-memory.dmp	autoit_exe
behavioral1/memory/1004-98-0x0000000000400000-0x0000000000498000-memory.dmp	autoit_exe
behavioral1/memory/2752-99-0x0000000000400000-0x0000000000498000-memory.dmp	autoit_exe
behavioral1/memory/2752-101-0x0000000000400000-0x0000000000498000-memory.dmp	autoit_exe
behavioral1/memory/2752-103-0x0000000000400000-0x0000000000498000-memory.dmp	autoit_exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\pic.jpg	DllHost.exe
File created	C:\Windows\SysWOW64\pic.jpg	a0e7f4b932dd8d1f25aa40ddb5993952_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\pic.jpg	a0e7f4b932dd8d1f25aa40ddb5993952_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\1035\scvhost.exe	a0e7f4b932dd8d1f25aa40ddb5993952_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\1035\msnmgsr.exe	scvhost.exe
File opened for modification	C:\Windows\SysWOW64\1035\msnmgsr.exe	scvhost.exe
File opened for modification	C:\Windows\SysWOW64\1035\Logs\17.08.2024.log	msnmgsr.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	scvhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msnmgsr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a0e7f4b932dd8d1f25aa40ddb5993952_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	scvhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msnmgsr.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2968	a0e7f4b932dd8d1f25aa40ddb5993952_JaffaCakes118.exe
2752	msnmgsr.exe
2752	msnmgsr.exe
2752	msnmgsr.exe
2752	msnmgsr.exe
2752	msnmgsr.exe
2752	msnmgsr.exe
2752	msnmgsr.exe
2752	msnmgsr.exe
2752	msnmgsr.exe
2752	msnmgsr.exe
2752	msnmgsr.exe
2752	msnmgsr.exe
2752	msnmgsr.exe
2752	msnmgsr.exe
2752	msnmgsr.exe
2752	msnmgsr.exe
2752	msnmgsr.exe
2752	msnmgsr.exe
2752	msnmgsr.exe
2752	msnmgsr.exe
2752	msnmgsr.exe
2752	msnmgsr.exe
2752	msnmgsr.exe
2752	msnmgsr.exe
2752	msnmgsr.exe
2752	msnmgsr.exe
2752	msnmgsr.exe
2752	msnmgsr.exe
2752	msnmgsr.exe
2752	msnmgsr.exe
2752	msnmgsr.exe
2752	msnmgsr.exe
2752	msnmgsr.exe
2752	msnmgsr.exe
2752	msnmgsr.exe
2752	msnmgsr.exe
2752	msnmgsr.exe
2752	msnmgsr.exe
2752	msnmgsr.exe
2752	msnmgsr.exe
2752	msnmgsr.exe
2752	msnmgsr.exe
2752	msnmgsr.exe
2752	msnmgsr.exe
2752	msnmgsr.exe
2752	msnmgsr.exe
2752	msnmgsr.exe
2752	msnmgsr.exe
2752	msnmgsr.exe
2752	msnmgsr.exe
2752	msnmgsr.exe
2752	msnmgsr.exe
2752	msnmgsr.exe
2752	msnmgsr.exe
2752	msnmgsr.exe
2752	msnmgsr.exe
2752	msnmgsr.exe
2752	msnmgsr.exe
2752	msnmgsr.exe
2752	msnmgsr.exe
2752	msnmgsr.exe
2752	msnmgsr.exe
2752	msnmgsr.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	2372	scvhost.exe
Token: SeIncBasePriorityPrivilege	2372	scvhost.exe
Token: 33	1004	scvhost.exe
Token: SeIncBasePriorityPrivilege	1004	scvhost.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2612	DllHost.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 2220	2968	a0e7f4b932dd8d1f25aa40ddb5993952_JaffaCakes118.exe	30
PID 2968 wrote to memory of 2220	2968	a0e7f4b932dd8d1f25aa40ddb5993952_JaffaCakes118.exe	30
PID 2968 wrote to memory of 2220	2968	a0e7f4b932dd8d1f25aa40ddb5993952_JaffaCakes118.exe	30
PID 2968 wrote to memory of 2220	2968	a0e7f4b932dd8d1f25aa40ddb5993952_JaffaCakes118.exe	30
PID 2968 wrote to memory of 2372	2968	a0e7f4b932dd8d1f25aa40ddb5993952_JaffaCakes118.exe	32
PID 2968 wrote to memory of 2372	2968	a0e7f4b932dd8d1f25aa40ddb5993952_JaffaCakes118.exe	32
PID 2968 wrote to memory of 2372	2968	a0e7f4b932dd8d1f25aa40ddb5993952_JaffaCakes118.exe	32
PID 2968 wrote to memory of 2372	2968	a0e7f4b932dd8d1f25aa40ddb5993952_JaffaCakes118.exe	32
PID 2372 wrote to memory of 2752	2372	scvhost.exe	33
PID 2372 wrote to memory of 2752	2372	scvhost.exe	33
PID 2372 wrote to memory of 2752	2372	scvhost.exe	33
PID 2372 wrote to memory of 2752	2372	scvhost.exe	33
PID 2752 wrote to memory of 1004	2752	msnmgsr.exe	37
PID 2752 wrote to memory of 1004	2752	msnmgsr.exe	37
PID 2752 wrote to memory of 1004	2752	msnmgsr.exe	37
PID 2752 wrote to memory of 1004	2752	msnmgsr.exe	37
PID 1004 wrote to memory of 448	1004	scvhost.exe	38
PID 1004 wrote to memory of 448	1004	scvhost.exe	38
PID 1004 wrote to memory of 448	1004	scvhost.exe	38
PID 1004 wrote to memory of 448	1004	scvhost.exe	38

C:\Users\Admin\AppData\Local\Temp\a0e7f4b932dd8d1f25aa40ddb5993952_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a0e7f4b932dd8d1f25aa40ddb5993952_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C C:\Windows\system32\pic.jpg
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2220
- C:\Windows\SysWOW64\1035\scvhost.exe
  C:\Windows\system32\1035\scvhost.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2372
- - C:\Windows\SysWOW64\1035\msnmgsr.exe
    C:\Windows\system32\1035\msnmgsr.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2752
  - - C:\Windows\SysWOW64\1035\scvhost.exe
      C:\Windows\system32\1035\scvhost.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1004
    - - C:\Windows\SysWOW64\1035\msnmgsr.exe
        
        C:\Windows\system32\1035\msnmgsr.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:448

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:2612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\pic.jpg

Filesize
81KB

MD5
020d77b6f0ff5aa0c038d4e900d4b0f2

SHA1
a0434f386b389e4ae253d2cd3aed22e55adc3c2a

SHA256
9cee3ca2d92c21baa398ad039c93ae502472ef9bc80d1178a5b3e35dff0107b1

SHA512
6048173feae919503b353701d07c673c888e4e33d6e5a7ce71d3ac501165888add9017e4be06df90a69c043f562a18de6080b2c2cbdb62187fc58c87391e16b8

Download Submit
\Windows\SysWOW64\1035\scvhost.exe

Filesize
484KB

MD5
a0e7f4b932dd8d1f25aa40ddb5993952

SHA1
8a18ebdaea81a9761b19c5f97b09ac320bbf97a4

SHA256
c97a52af30e16ea87671ec0e13f5272627d140ba8f52592425f86edfac887465

SHA512
e91d1b03ddb7d07cfb559b06539afafc403ce3538c10ccc9d03255129e03e94631c404411a616a7e4aa9ff61a91145bd28cb96fa35db9e83e5e4aaa33bb11461

Download Submit
memory/448-88-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/448-90-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/1004-93-0x0000000003940000-0x00000000039D8000-memory.dmp

Filesize
608KB

Download
memory/1004-98-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/1004-86-0x0000000003940000-0x00000000039D8000-memory.dmp

Filesize
608KB

Download
memory/1004-92-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/2220-60-0x00000000004F0000-0x00000000004F2000-memory.dmp

Filesize
8KB

Download
memory/2372-13-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/2372-64-0x00000000038D0000-0x0000000003968000-memory.dmp

Filesize
608KB

Download
memory/2372-63-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/2372-70-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/2372-26-0x00000000038D0000-0x0000000003968000-memory.dmp

Filesize
608KB

Download
memory/2372-82-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/2612-61-0x00000000000F0000-0x00000000000F2000-memory.dmp

Filesize
8KB

Download
memory/2752-75-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/2752-67-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/2752-79-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/2752-81-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/2752-103-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/2752-73-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/2752-71-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/2752-69-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/2752-91-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/2752-77-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/2752-66-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/2752-95-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/2752-97-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/2752-101-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/2752-99-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/2968-12-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/2968-0-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download