c97a52af30e16ea87671ec0e13f5272627d140ba8f52592425f86edfac887465

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
17/08/2024, 02:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a0e7f4b932dd8d1f25aa40ddb5993952_JaffaCakes118.exe
Size

484KB
MD5

a0e7f4b932dd8d1f25aa40ddb5993952
SHA1

8a18ebdaea81a9761b19c5f97b09ac320bbf97a4
SHA256

c97a52af30e16ea87671ec0e13f5272627d140ba8f52592425f86edfac887465
SHA512

e91d1b03ddb7d07cfb559b06539afafc403ce3538c10ccc9d03255129e03e94631c404411a616a7e4aa9ff61a91145bd28cb96fa35db9e83e5e4aaa33bb11461
SSDEEP

12288:jUp4kk3oIXjZGhPtnZoGTTAA4fpKrwOJCgrOyMfI+In0:Y4JoIMhPtnr4A4B0cgrOyL0

Score

7^/10

discovery persistence upx

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
2160	scvhost.exe
3172	msnmgsr.exe
3800	scvhost.exe
5008	msnmgsr.exe

UPX packed file 25 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4900-0-0x0000000000400000-0x0000000000498000-memory.dmp	upx
behavioral2/files/0x00080000000234d1-10.dat	upx
behavioral2/memory/2160-12-0x0000000000400000-0x0000000000498000-memory.dmp	upx
behavioral2/memory/4900-14-0x0000000000400000-0x0000000000498000-memory.dmp	upx
behavioral2/memory/2160-23-0x0000000000400000-0x0000000000498000-memory.dmp	upx
behavioral2/memory/3172-26-0x0000000000400000-0x0000000000498000-memory.dmp	upx
behavioral2/memory/3172-25-0x0000000000400000-0x0000000000498000-memory.dmp	upx
behavioral2/memory/3172-28-0x0000000000400000-0x0000000000498000-memory.dmp	upx
behavioral2/memory/2160-29-0x0000000000400000-0x0000000000498000-memory.dmp	upx
behavioral2/memory/3172-30-0x0000000000400000-0x0000000000498000-memory.dmp	upx
behavioral2/memory/3172-32-0x0000000000400000-0x0000000000498000-memory.dmp	upx
behavioral2/memory/3172-34-0x0000000000400000-0x0000000000498000-memory.dmp	upx
behavioral2/memory/3172-36-0x0000000000400000-0x0000000000498000-memory.dmp	upx
behavioral2/memory/3172-38-0x0000000000400000-0x0000000000498000-memory.dmp	upx
behavioral2/memory/3172-40-0x0000000000400000-0x0000000000498000-memory.dmp	upx
behavioral2/memory/2160-41-0x0000000000400000-0x0000000000498000-memory.dmp	upx
behavioral2/memory/5008-45-0x0000000000400000-0x0000000000498000-memory.dmp	upx
behavioral2/memory/3172-46-0x0000000000400000-0x0000000000498000-memory.dmp	upx
behavioral2/memory/3800-47-0x0000000000400000-0x0000000000498000-memory.dmp	upx
behavioral2/memory/3172-49-0x0000000000400000-0x0000000000498000-memory.dmp	upx
behavioral2/memory/3172-51-0x0000000000400000-0x0000000000498000-memory.dmp	upx
behavioral2/memory/3800-52-0x0000000000400000-0x0000000000498000-memory.dmp	upx
behavioral2/memory/3172-53-0x0000000000400000-0x0000000000498000-memory.dmp	upx
behavioral2/memory/3172-55-0x0000000000400000-0x0000000000498000-memory.dmp	upx
behavioral2/memory/3172-57-0x0000000000400000-0x0000000000498000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSWINSCK.OCX = "C:\\Windows\\system32\\1035\\scvhost.exe"	msnmgsr.exe

AutoIT Executable 23 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/2160-12-0x0000000000400000-0x0000000000498000-memory.dmp	autoit_exe
behavioral2/memory/4900-14-0x0000000000400000-0x0000000000498000-memory.dmp	autoit_exe
behavioral2/memory/2160-23-0x0000000000400000-0x0000000000498000-memory.dmp	autoit_exe
behavioral2/memory/3172-26-0x0000000000400000-0x0000000000498000-memory.dmp	autoit_exe
behavioral2/memory/3172-25-0x0000000000400000-0x0000000000498000-memory.dmp	autoit_exe
behavioral2/memory/3172-28-0x0000000000400000-0x0000000000498000-memory.dmp	autoit_exe
behavioral2/memory/2160-29-0x0000000000400000-0x0000000000498000-memory.dmp	autoit_exe
behavioral2/memory/3172-30-0x0000000000400000-0x0000000000498000-memory.dmp	autoit_exe
behavioral2/memory/3172-32-0x0000000000400000-0x0000000000498000-memory.dmp	autoit_exe
behavioral2/memory/3172-34-0x0000000000400000-0x0000000000498000-memory.dmp	autoit_exe
behavioral2/memory/3172-36-0x0000000000400000-0x0000000000498000-memory.dmp	autoit_exe
behavioral2/memory/3172-38-0x0000000000400000-0x0000000000498000-memory.dmp	autoit_exe
behavioral2/memory/3172-40-0x0000000000400000-0x0000000000498000-memory.dmp	autoit_exe
behavioral2/memory/2160-41-0x0000000000400000-0x0000000000498000-memory.dmp	autoit_exe
behavioral2/memory/5008-45-0x0000000000400000-0x0000000000498000-memory.dmp	autoit_exe
behavioral2/memory/3172-46-0x0000000000400000-0x0000000000498000-memory.dmp	autoit_exe
behavioral2/memory/3800-47-0x0000000000400000-0x0000000000498000-memory.dmp	autoit_exe
behavioral2/memory/3172-49-0x0000000000400000-0x0000000000498000-memory.dmp	autoit_exe
behavioral2/memory/3172-51-0x0000000000400000-0x0000000000498000-memory.dmp	autoit_exe
behavioral2/memory/3800-52-0x0000000000400000-0x0000000000498000-memory.dmp	autoit_exe
behavioral2/memory/3172-53-0x0000000000400000-0x0000000000498000-memory.dmp	autoit_exe
behavioral2/memory/3172-55-0x0000000000400000-0x0000000000498000-memory.dmp	autoit_exe
behavioral2/memory/3172-57-0x0000000000400000-0x0000000000498000-memory.dmp	autoit_exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\1035\msnmgsr.exe	scvhost.exe
File opened for modification	C:\Windows\SysWOW64\1035\msnmgsr.exe	scvhost.exe
File opened for modification	C:\Windows\SysWOW64\1035\Logs\17.08.2024.log	msnmgsr.exe
File created	C:\Windows\SysWOW64\pic.jpg	a0e7f4b932dd8d1f25aa40ddb5993952_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\pic.jpg	a0e7f4b932dd8d1f25aa40ddb5993952_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\1035\scvhost.exe	a0e7f4b932dd8d1f25aa40ddb5993952_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msnmgsr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	scvhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msnmgsr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a0e7f4b932dd8d1f25aa40ddb5993952_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	scvhost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4900	a0e7f4b932dd8d1f25aa40ddb5993952_JaffaCakes118.exe
4900	a0e7f4b932dd8d1f25aa40ddb5993952_JaffaCakes118.exe
3172	msnmgsr.exe
3172	msnmgsr.exe
3172	msnmgsr.exe
3172	msnmgsr.exe
3172	msnmgsr.exe
3172	msnmgsr.exe
3172	msnmgsr.exe
3172	msnmgsr.exe
3172	msnmgsr.exe
3172	msnmgsr.exe
3172	msnmgsr.exe
3172	msnmgsr.exe
3172	msnmgsr.exe
3172	msnmgsr.exe
3172	msnmgsr.exe
3172	msnmgsr.exe
3172	msnmgsr.exe
3172	msnmgsr.exe
3172	msnmgsr.exe
3172	msnmgsr.exe
3172	msnmgsr.exe
3172	msnmgsr.exe
3172	msnmgsr.exe
3172	msnmgsr.exe
3172	msnmgsr.exe
3172	msnmgsr.exe
3172	msnmgsr.exe
3172	msnmgsr.exe
3172	msnmgsr.exe
3172	msnmgsr.exe
3172	msnmgsr.exe
3172	msnmgsr.exe
3172	msnmgsr.exe
3172	msnmgsr.exe
3172	msnmgsr.exe
3172	msnmgsr.exe
3172	msnmgsr.exe
3172	msnmgsr.exe
3172	msnmgsr.exe
3172	msnmgsr.exe
3172	msnmgsr.exe
3172	msnmgsr.exe
3172	msnmgsr.exe
3172	msnmgsr.exe
3172	msnmgsr.exe
3172	msnmgsr.exe
3172	msnmgsr.exe
3172	msnmgsr.exe
3172	msnmgsr.exe
3172	msnmgsr.exe
3172	msnmgsr.exe
3172	msnmgsr.exe
3172	msnmgsr.exe
3172	msnmgsr.exe
3172	msnmgsr.exe
3172	msnmgsr.exe
3172	msnmgsr.exe
3172	msnmgsr.exe
3172	msnmgsr.exe
3172	msnmgsr.exe
3172	msnmgsr.exe
3172	msnmgsr.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	2160	scvhost.exe
Token: SeIncBasePriorityPrivilege	2160	scvhost.exe
Token: 33	3800	scvhost.exe
Token: SeIncBasePriorityPrivilege	3800	scvhost.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4900 wrote to memory of 5104	4900	a0e7f4b932dd8d1f25aa40ddb5993952_JaffaCakes118.exe	85
PID 4900 wrote to memory of 5104	4900	a0e7f4b932dd8d1f25aa40ddb5993952_JaffaCakes118.exe	85
PID 4900 wrote to memory of 5104	4900	a0e7f4b932dd8d1f25aa40ddb5993952_JaffaCakes118.exe	85
PID 4900 wrote to memory of 2160	4900	a0e7f4b932dd8d1f25aa40ddb5993952_JaffaCakes118.exe	86
PID 4900 wrote to memory of 2160	4900	a0e7f4b932dd8d1f25aa40ddb5993952_JaffaCakes118.exe	86
PID 4900 wrote to memory of 2160	4900	a0e7f4b932dd8d1f25aa40ddb5993952_JaffaCakes118.exe	86
PID 2160 wrote to memory of 3172	2160	scvhost.exe	88
PID 2160 wrote to memory of 3172	2160	scvhost.exe	88
PID 2160 wrote to memory of 3172	2160	scvhost.exe	88
PID 3172 wrote to memory of 3800	3172	msnmgsr.exe	102
PID 3172 wrote to memory of 3800	3172	msnmgsr.exe	102
PID 3172 wrote to memory of 3800	3172	msnmgsr.exe	102
PID 3800 wrote to memory of 5008	3800	scvhost.exe	103
PID 3800 wrote to memory of 5008	3800	scvhost.exe	103
PID 3800 wrote to memory of 5008	3800	scvhost.exe	103

C:\Users\Admin\AppData\Local\Temp\a0e7f4b932dd8d1f25aa40ddb5993952_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a0e7f4b932dd8d1f25aa40ddb5993952_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4900
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C C:\Windows\system32\pic.jpg
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5104
- C:\Windows\SysWOW64\1035\scvhost.exe
  C:\Windows\system32\1035\scvhost.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2160
- - C:\Windows\SysWOW64\1035\msnmgsr.exe
    C:\Windows\system32\1035\msnmgsr.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3172
  - - C:\Windows\SysWOW64\1035\scvhost.exe
      C:\Windows\system32\1035\scvhost.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3800
    - - C:\Windows\SysWOW64\1035\msnmgsr.exe
        
        C:\Windows\system32\1035\msnmgsr.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\autB4F8.tmp

Filesize
81KB

MD5
020d77b6f0ff5aa0c038d4e900d4b0f2

SHA1
a0434f386b389e4ae253d2cd3aed22e55adc3c2a

SHA256
9cee3ca2d92c21baa398ad039c93ae502472ef9bc80d1178a5b3e35dff0107b1

SHA512
6048173feae919503b353701d07c673c888e4e33d6e5a7ce71d3ac501165888add9017e4be06df90a69c043f562a18de6080b2c2cbdb62187fc58c87391e16b8

Download Submit
C:\Windows\SysWOW64\1035\scvhost.exe

Filesize
484KB

MD5
a0e7f4b932dd8d1f25aa40ddb5993952

SHA1
8a18ebdaea81a9761b19c5f97b09ac320bbf97a4

SHA256
c97a52af30e16ea87671ec0e13f5272627d140ba8f52592425f86edfac887465

SHA512
e91d1b03ddb7d07cfb559b06539afafc403ce3538c10ccc9d03255129e03e94631c404411a616a7e4aa9ff61a91145bd28cb96fa35db9e83e5e4aaa33bb11461

Download Submit
memory/2160-29-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/2160-12-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/2160-41-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/2160-23-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/3172-34-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/3172-40-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/3172-28-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/3172-26-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/3172-30-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/3172-32-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/3172-57-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/3172-36-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/3172-38-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/3172-25-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/3172-55-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/3172-53-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/3172-46-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/3172-51-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/3172-49-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/3800-47-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/3800-52-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/4900-14-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/4900-0-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/5008-45-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download