Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/08/2024, 03:49

General

  • Target

    a1184e1690e4d0e3006f67ef21707693_JaffaCakes118.exe

  • Size

    50KB

  • MD5

    a1184e1690e4d0e3006f67ef21707693

  • SHA1

    0865edbe60c018baa5a0014a63977a4da008f5ca

  • SHA256

    33c396a39aae14f9ca745910a4b111bb812559a4bbe154cadca1381f2f5a9c1d

  • SHA512

    7ac54be3a7489d8c3bcd4b277b9fe8e671c7485137810fca90b2b89aa0c5134db93dbfe319d42e647d34d1e1b6dcf353c8a0201580660bfaeeece0bede9595ac

  • SSDEEP

    768:1kpLA8BtBV0QJcW5wqInmNSfyvwx+BKXCJW+trdvsWCJn66kvOR:QkQJcqwmIfj+ECJG/kvO

Malware Config

Signatures

  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Service Discovery 1 TTPs 1 IoCs

    Attempt to gather information on host's network.

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

  • Password Policy Discovery 1 TTPs

    Attempt to access detailed information about the password policy used within an enterprise network.

  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Domain Trust Discovery 1 TTPs

    Attempt gathering information on domain trust relationships.

  • Permission Groups Discovery: Domain Groups 1 TTPs

    Attempt to find domain-level groups and permission settings.

  • Permission Groups Discovery: Local Groups 1 TTPs

    Attempt to find local system groups and permission settings.

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Connections Discovery 1 TTPs 1 IoCs

    Attempt to get a listing of network connections.

  • Discovers systems in the same network 1 TTPs 1 IoCs
  • Gathers network information 2 TTPs 3 IoCs

    Uses commandline utility to view network configuration.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Runs net.exe
  • Suspicious use of AdjustPrivilegeToken 38 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a1184e1690e4d0e3006f67ef21707693_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a1184e1690e4d0e3006f67ef21707693_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2328
    • C:\ProgramData\Application Data\wmimgmt.exe
      "C:\ProgramData\Application Data\wmimgmt.exe"
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4660
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /v:on /c C:\Users\Admin\AppData\Local\Temp\ghi.bat
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4284
        • C:\Windows\SysWOW64\findstr.exe
          findstr /s "YM.CGP_" "C:\Users\Admin"\..\*.txt
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1484
        • C:\Windows\SysWOW64\chcp.com
          chcp
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1000
        • C:\Windows\SysWOW64\net.exe
          net user
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4880
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 user
            5⤵
            • System Location Discovery: System Language Discovery
            PID:224
        • C:\Windows\SysWOW64\net.exe
          net localgroup administrators
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2944
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 localgroup administrators
            5⤵
            • System Location Discovery: System Language Discovery
            PID:432
        • C:\Windows\SysWOW64\tasklist.exe
          tasklist
          4⤵
          • Enumerates processes with tasklist
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:4904
        • C:\Windows\SysWOW64\systeminfo.exe
          systeminfo
          4⤵
          • System Location Discovery: System Language Discovery
          • Gathers system information
          PID:4468
        • C:\Windows\SysWOW64\reg.exe
          reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4020
        • C:\Windows\SysWOW64\find.exe
          find "REG_"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1352
        • C:\Windows\SysWOW64\reg.exe
          reg query HKEY_CURRENT_USER\Software\Microsoft\Office
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4104
        • C:\Windows\SysWOW64\reg.exe
          reg query HKEY_CURRENT_USER\Software\Microsoft\Office\8.0\Common\UserInfo
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3432
        • C:\Windows\SysWOW64\reg.exe
          reg query HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Common\UserInfo
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3604
        • C:\Windows\SysWOW64\reg.exe
          reg query HKEY_CURRENT_USER\Software\Microsoft\Office\10.0\Common\UserInfo
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4032
        • C:\Windows\SysWOW64\reg.exe
          reg query HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Common\UserInfo
          4⤵
            PID:2744
          • C:\Windows\SysWOW64\reg.exe
            reg query HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\UserInfo
            4⤵
            • System Location Discovery: System Language Discovery
            PID:1856
          • C:\Windows\SysWOW64\reg.exe
            reg query HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Common\UserInfo
            4⤵
            • System Location Discovery: System Language Discovery
            PID:208
          • C:\Windows\SysWOW64\reg.exe
            reg query "HKEY_CURRENT_USER\Software\Microsoft\Internet Account Manager\Accounts" /s
            4⤵
            • System Location Discovery: System Language Discovery
            PID:4420
          • C:\Windows\SysWOW64\reg.exe
            reg query "HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts" /s
            4⤵
            • Accesses Microsoft Outlook accounts
            • System Location Discovery: System Language Discovery
            PID:536
          • C:\Windows\SysWOW64\reg.exe
            reg query "HKEY_CURRENT_USER\Software\Mirabilis\ICQ" /s
            4⤵
            • System Location Discovery: System Language Discovery
            PID:316
          • C:\Windows\SysWOW64\reg.exe
            reg query "HKEY_CURRENT_USER\Software\Microsoft\MSNMessenger" /s
            4⤵
            • System Location Discovery: System Language Discovery
            PID:4384
          • C:\Windows\SysWOW64\net.exe
            net user Admin
            4⤵
              PID:2268
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 user Admin
                5⤵
                • System Location Discovery: System Language Discovery
                PID:3652
            • C:\Windows\SysWOW64\net.exe
              net user Admin /domain
              4⤵
              • System Location Discovery: System Language Discovery
              PID:2296
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 user Admin /domain
                5⤵
                • System Location Discovery: System Language Discovery
                PID:1344
            • C:\Windows\SysWOW64\net.exe
              net group
              4⤵
              • System Location Discovery: System Language Discovery
              PID:4180
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 group
                5⤵
                  PID:4816
              • C:\Windows\SysWOW64\net.exe
                net group /domain
                4⤵
                • System Location Discovery: System Language Discovery
                PID:4624
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 group /domain
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:2704
              • C:\Windows\SysWOW64\net.exe
                net group "domain admins"
                4⤵
                • System Location Discovery: System Language Discovery
                PID:724
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 group "domain admins"
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:4444
              • C:\Windows\SysWOW64\net.exe
                net group "domain admins" /domain
                4⤵
                • System Location Discovery: System Language Discovery
                PID:1768
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 group "domain admins" /domain
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:680
              • C:\Windows\SysWOW64\net.exe
                net group "domain computers"
                4⤵
                • System Location Discovery: System Language Discovery
                PID:3156
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 group "domain computers"
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:2984
              • C:\Windows\SysWOW64\net.exe
                net group "domain computers" /domain
                4⤵
                • System Location Discovery: System Language Discovery
                PID:1324
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 group "domain computers" /domain
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:3908
              • C:\Windows\SysWOW64\net.exe
                net group "domain controllers"
                4⤵
                • System Location Discovery: System Language Discovery
                PID:3812
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 group "domain controllers"
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:636
              • C:\Windows\SysWOW64\net.exe
                net group "domain controllers" /domain
                4⤵
                • System Location Discovery: System Language Discovery
                PID:1372
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 group "domain controllers" /domain
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:664
              • C:\Windows\SysWOW64\ipconfig.exe
                ipconfig /all
                4⤵
                • System Location Discovery: System Language Discovery
                • Gathers network information
                PID:1520
              • C:\Windows\SysWOW64\NETSTAT.EXE
                netstat -ano
                4⤵
                • System Location Discovery: System Language Discovery
                • System Network Connections Discovery
                • Gathers network information
                • Suspicious use of AdjustPrivilegeToken
                PID:868
              • C:\Windows\SysWOW64\ARP.EXE
                arp -a
                4⤵
                • Network Service Discovery
                • System Location Discovery: System Language Discovery
                PID:1328
              • C:\Windows\SysWOW64\NETSTAT.EXE
                netstat -r
                4⤵
                • System Location Discovery: System Language Discovery
                • Gathers network information
                PID:2288
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:228
                  • C:\Windows\SysWOW64\ROUTE.EXE
                    C:\Windows\system32\route.exe print
                    6⤵
                    • System Location Discovery: System Language Discovery
                    PID:3496
              • C:\Windows\SysWOW64\net.exe
                net start
                4⤵
                • System Location Discovery: System Language Discovery
                PID:1864
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 start
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:4584
              • C:\Windows\SysWOW64\net.exe
                net use
                4⤵
                • System Location Discovery: System Language Discovery
                PID:4832
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" echo n"
                4⤵
                  PID:2944
                • C:\Windows\SysWOW64\net.exe
                  net share
                  4⤵
                  • System Location Discovery: System Language Discovery
                  PID:5044
                  • C:\Windows\SysWOW64\net1.exe
                    C:\Windows\system32\net1 share
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:4636
                • C:\Windows\SysWOW64\net.exe
                  net view /domain
                  4⤵
                  • System Location Discovery: System Language Discovery
                  • Discovers systems in the same network
                  PID:3080
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\s.log "
                  4⤵
                    PID:4948
                  • C:\Windows\SysWOW64\find.exe
                    find /i /v "------"
                    4⤵
                    • System Location Discovery: System Language Discovery
                    PID:4560
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\t.log "
                    4⤵
                    • System Location Discovery: System Language Discovery
                    PID:2988
                  • C:\Windows\SysWOW64\find.exe
                    find /i /v "domain"
                    4⤵
                    • System Location Discovery: System Language Discovery
                    PID:3232
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\s.log "
                    4⤵
                    • System Location Discovery: System Language Discovery
                    PID:3432
                  • C:\Windows\SysWOW64\find.exe
                    find /i /v "¬A╛╣"
                    4⤵
                    • System Location Discovery: System Language Discovery
                    PID:2828
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\t.log "
                    4⤵
                    • System Location Discovery: System Language Discovery
                    PID:4000
                  • C:\Windows\SysWOW64\find.exe
                    find /i /v "░⌡ªµª¿"
                    4⤵
                    • System Location Discovery: System Language Discovery
                    PID:4008
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\s.log "
                    4⤵
                    • System Location Discovery: System Language Discovery
                    PID:3948
                  • C:\Windows\SysWOW64\find.exe
                    find /i /v "├ⁿ┴ε"
                    4⤵
                    • System Location Discovery: System Language Discovery
                    PID:4364
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\t.log "
                    4⤵
                    • System Location Discovery: System Language Discovery
                    PID:220
                  • C:\Windows\SysWOW64\find.exe
                    find /i /v "completed successfully"
                    4⤵
                    • System Location Discovery: System Language Discovery
                    PID:536

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\ProgramData\wmimgmt.exe

              Filesize

              50KB

              MD5

              a1184e1690e4d0e3006f67ef21707693

              SHA1

              0865edbe60c018baa5a0014a63977a4da008f5ca

              SHA256

              33c396a39aae14f9ca745910a4b111bb812559a4bbe154cadca1381f2f5a9c1d

              SHA512

              7ac54be3a7489d8c3bcd4b277b9fe8e671c7485137810fca90b2b89aa0c5134db93dbfe319d42e647d34d1e1b6dcf353c8a0201580660bfaeeece0bede9595ac

            • C:\Users\Admin\AppData\Local\Temp\INFO.TXT

              Filesize

              49B

              MD5

              9a8c2d0c510fd316456d479cd25a9d6c

              SHA1

              ea9fc69f9a8c7a2ed97a3f6ce6a9460f46b8e0d1

              SHA256

              75895b0b466a254f21114d9cf71d18ef2413a40aed6c3c989b6496dbb345068e

              SHA512

              617aecd798d2bc8d08cf9d771b3138068fda70091c9dac7d6a031a322829d55960b601baa3085301f34961c0eccaa18e20aa3823469d3d0eb21a639fcf61a0b8

            • C:\Users\Admin\AppData\Local\Temp\INFO.TXT

              Filesize

              12KB

              MD5

              ea0bc526818c5ff56b9837548daa6edb

              SHA1

              4d08721359324ea2738eba56dad5c560adf34d6e

              SHA256

              9580d60a63da98dd72d7784ef006b22326bd2df968ab2d5adb79ce19d676abdf

              SHA512

              f21b127dbbdd7881ef37eb3f49ca934727b9be7181a6826c3453a862a92e88672c1ffc1dbef4c6dce197c24165b145986a6d938146fb52e0bb870af3f7154372

            • C:\Users\Admin\AppData\Local\Temp\INFO.TXT

              Filesize

              37.5MB

              MD5

              098de1ee4d2957ae71d0529da3db74fc

              SHA1

              ff82f2cfb38c16a499e4886e56f35d03941188ad

              SHA256

              009f4757be1dc2f3fb8ca37ba090f5c5fd61d2fd63adeae99cb38111f412989a

              SHA512

              649057e16d2b7cfb474390fc038d16fb7835128eb19becc118da0aafdedf09766530bac1971d61f28543fff4674c335c49866feba99bbbec9ad2fd2d56142ffc

            • C:\Users\Admin\AppData\Local\Temp\L4SD\5438C5DD.db

              Filesize

              254B

              MD5

              69d9638d6b35eb1c500d9e7fce372f7e

              SHA1

              4e35e916ad3856e32e31cf220d2806fa6dbc9d26

              SHA256

              75afed2f53a2d7e83c7dd591b03846918ad120c854000e35d5b229d35da63e4f

              SHA512

              17cf8a32e85ee07dab30d7a9925bd9698a5fadfd75fe75613461a7862a96a4284381e97306d89c89e760a9dd0c84e315b474c7a5768b37c15a6a3bdb9bbe3cda

            • C:\Users\Admin\AppData\Local\Temp\drivers.p

              Filesize

              15B

              MD5

              4ff8e80638f36abd8fb131c19425317b

              SHA1

              358665afaf5f88dfebcdb7c56e963693c520c136

              SHA256

              6b8ceb900443f4924efd3187693038965ad7edb488879305489aa72d78f69626

              SHA512

              d4e6e3d789bc76102c500b46a5aa799c5ebfc432a44117aa0b7c7512439d33a423630b963fb04cda1da17a7f6517b276a3e9298c17cbf795964090f4b9e5d8f1

            • C:\Users\Admin\AppData\Local\Temp\ghi.bat

              Filesize

              4KB

              MD5

              b91bc08162fbc3445c5424b77183b807

              SHA1

              52b2a60db40cdcc655648a65210ed26219c033e1

              SHA256

              7cec366268426139777f0776ba3cbce6a50f4112a96fa88190bee2ebe665275a

              SHA512

              2f19fe96209dcb4e189a8fecddcac40ebed8ce0c6999a469268b57e74e9e830a7b03c1d024c616797ae9029a4566fa96006f29e1fa042bca1534d1d815ae8b35

            • C:\Users\Public\Documents\Media\5438C5DD.db

              Filesize

              64B

              MD5

              43859f5e2fda2f87351ac51dc95769ca

              SHA1

              ac49ccb11214b79a94a745be88a8759327f160e9

              SHA256

              4faa5f6eec70f3a94364c77e74e89c8722ee1157d7bfb1172a2c7a2d01721b83

              SHA512

              96abbff7014a6364bd8617b490d79ca2f4d5e4d4cc56efffeb23ab212d15f1b989a6a1814a06c6b6279ab04da3018b420ee5e2469df725f9aa9b26ffe50b0688

            • memory/2328-0-0x0000000000400000-0x0000000000425000-memory.dmp

              Filesize

              148KB

            • memory/2328-7-0x0000000000400000-0x0000000000425000-memory.dmp

              Filesize

              148KB

            • memory/4660-62-0x0000000000400000-0x0000000000425000-memory.dmp

              Filesize

              148KB