Analysis

  • max time kernel
    149s
  • max time network
    129s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-08-2024 21:38

General

  • Target

    b524bcaa36d0e6bd719d96a27f9277e9_JaffaCakes118.exe

  • Size

    403KB

  • MD5

    b524bcaa36d0e6bd719d96a27f9277e9

  • SHA1

    3215d49449e2e044d1c6ced7c755b95f6115d864

  • SHA256

    cff4ec8251196642821acb071b7d68bc93c05af9261d206a58c379ab922fd4ab

  • SHA512

    b07e102ab181a2b2c2f7f44645886097f17512b7e593e371552976b52e39dc998c4e66c1ad80076e558207e19b56811a4cc17777ea4ef005017987d4d2351799

  • SSDEEP

    6144:7jtNSS4VNERBnS5NF2idZecnl20lHRxp3gxncduD7yB9VCO6Sco4q8+dE6CqS:0mRB43F3Z4mxx6DqVTVOCS

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 41 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 48 IoCs
  • Suspicious use of SetWindowsHookEx 24 IoCs
  • Suspicious use of WriteProcessMemory 52 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\b524bcaa36d0e6bd719d96a27f9277e9_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\b524bcaa36d0e6bd719d96a27f9277e9_JaffaCakes118.exe"
    1⤵
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3772
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\\delmeexe.bat
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3868
  • C:\Windows\SysWOW64\winxp.exe
    C:\Windows\SysWOW64\winxp.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2388
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" about:blank
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4552
      • C:\Program Files\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE" about:blank
        3⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4456
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4456 CREDAT:17410 /prefetch:2
          4⤵
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Modifies data under HKEY_USERS
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4704
          • C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\BHO\ie_to_edge_stub.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=20030
            5⤵
            • Modifies data under HKEY_USERS
            • Suspicious use of WriteProcessMemory
            PID:2096
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=20030
              6⤵
              • Modifies data under HKEY_USERS
              PID:1100
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4456 CREDAT:82948 /prefetch:2
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2868
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4456 CREDAT:82952 /prefetch:2
          4⤵
          • System Location Discovery: System Language Discovery
          • Modifies data under HKEY_USERS
          • Suspicious use of SetWindowsHookEx
          PID:2120
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4456 CREDAT:82956 /prefetch:2
          4⤵
          • System Location Discovery: System Language Discovery
          • Modifies data under HKEY_USERS
          • Suspicious use of SetWindowsHookEx
          PID:4232
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4456 CREDAT:82962 /prefetch:2
          4⤵
          • System Location Discovery: System Language Discovery
          • Modifies data under HKEY_USERS
          • Suspicious use of SetWindowsHookEx
          PID:4092
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" about:blank
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1212
      • C:\Program Files\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE" about:blank
        3⤵
          PID:1060
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" about:blank
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3392
        • C:\Program Files\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files\Internet Explorer\IEXPLORE.EXE" about:blank
          3⤵
            PID:1260
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" about:blank
          2⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3060
          • C:\Program Files\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files\Internet Explorer\IEXPLORE.EXE" about:blank
            3⤵
              PID:4848
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" about:blank
            2⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1464
            • C:\Program Files\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files\Internet Explorer\IEXPLORE.EXE" about:blank
              3⤵
              • Modifies data under HKEY_USERS
              PID:368
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" about:blank
            2⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2700
            • C:\Program Files\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files\Internet Explorer\IEXPLORE.EXE" about:blank
              3⤵
                PID:3876
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4336,i,8293235976513689021,7261015831736501466,262144 --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:8
            1⤵
              PID:3936

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\delmeexe.bat

              Filesize

              231B

              MD5

              70e3edabf568f0cc8ea5a02ef793ae2c

              SHA1

              1903911ca37afa98d40af60992ddcf4f42ea8fe2

              SHA256

              98507224a1fa837239c9b5f5cec13d25ed8f456530ad08a6318ca83c96a3128b

              SHA512

              8782e6d85b90dfb2a83396b525ffd49e2c00df8027b2ea3b6fd4633dc811136f219a7d201367b77916909a3f7dbb5676943dba0587b9d1c69fa532898a428e71

            • C:\Windows\SysWOW64\winxp.exe

              Filesize

              403KB

              MD5

              b524bcaa36d0e6bd719d96a27f9277e9

              SHA1

              3215d49449e2e044d1c6ced7c755b95f6115d864

              SHA256

              cff4ec8251196642821acb071b7d68bc93c05af9261d206a58c379ab922fd4ab

              SHA512

              b07e102ab181a2b2c2f7f44645886097f17512b7e593e371552976b52e39dc998c4e66c1ad80076e558207e19b56811a4cc17777ea4ef005017987d4d2351799

            • C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

              Filesize

              4KB

              MD5

              da597791be3b6e732f0bc8b20e38ee62

              SHA1

              1125c45d285c360542027d7554a5c442288974de

              SHA256

              5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

              SHA512

              d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

            • C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\suggestions[1].en-US

              Filesize

              17KB

              MD5

              5a34cb996293fde2cb7a4ac89587393a

              SHA1

              3c96c993500690d1a77873cd62bc639b3a10653f

              SHA256

              c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

              SHA512

              e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

            • C:\Windows\System32\config\systemprofile\Favorites\desktop.ini

              Filesize

              402B

              MD5

              881dfac93652edb0a8228029ba92d0f5

              SHA1

              5b317253a63fecb167bf07befa05c5ed09c4ccea

              SHA256

              a45e345556901cd98b9bf8700b2a263f1da2b2e53dbdf69b9e6cfab6e0bd3464

              SHA512

              592b24deb837d6b82c692da781b8a69d9fa20bbaa3041d6c651839e72f45ac075a86cb967ea2df08fa0635ae28d6064a900f5d15180b9037bb8ba02f9e8e1810

            • C:\Windows\Temp\Kno83F0.tmp

              Filesize

              88KB

              MD5

              002d5646771d31d1e7c57990cc020150

              SHA1

              a28ec731f9106c252f313cca349a68ef94ee3de9

              SHA256

              1e2e25bf730ff20c89d57aa38f7f34be7690820e8279b20127d0014dd27b743f

              SHA512

              689e90e7d83eef054a168b98ba2b8d05ab6ff8564e199d4089215ad3fe33440908e687aa9ad7d94468f9f57a4cc19842d53a9cd2f17758bdadf0503df63629c6

            • memory/2388-104-0x0000000000400000-0x00000000004A9000-memory.dmp

              Filesize

              676KB

            • memory/2388-88-0x0000000000400000-0x00000000004A9000-memory.dmp

              Filesize

              676KB

            • memory/2388-89-0x0000000000400000-0x00000000004A9000-memory.dmp

              Filesize

              676KB

            • memory/2388-93-0x0000000000400000-0x00000000004A9000-memory.dmp

              Filesize

              676KB

            • memory/2388-57-0x0000000000400000-0x00000000004A9000-memory.dmp

              Filesize

              676KB

            • memory/2388-107-0x0000000000400000-0x00000000004A9000-memory.dmp

              Filesize

              676KB

            • memory/2388-108-0x0000000000400000-0x00000000004A9000-memory.dmp

              Filesize

              676KB

            • memory/3772-25-0x00000000032E0000-0x00000000033E0000-memory.dmp

              Filesize

              1024KB

            • memory/3772-3-0x0000000002210000-0x0000000002211000-memory.dmp

              Filesize

              4KB

            • memory/3772-19-0x00000000032E0000-0x00000000032E1000-memory.dmp

              Filesize

              4KB

            • memory/3772-18-0x00000000032E0000-0x00000000032E1000-memory.dmp

              Filesize

              4KB

            • memory/3772-17-0x00000000032E0000-0x00000000032E1000-memory.dmp

              Filesize

              4KB

            • memory/3772-16-0x00000000032E0000-0x00000000032E1000-memory.dmp

              Filesize

              4KB

            • memory/3772-15-0x00000000032E0000-0x00000000032E1000-memory.dmp

              Filesize

              4KB

            • memory/3772-14-0x00000000032E0000-0x00000000032E1000-memory.dmp

              Filesize

              4KB

            • memory/3772-13-0x00000000032E0000-0x00000000032E1000-memory.dmp

              Filesize

              4KB

            • memory/3772-12-0x00000000032F0000-0x00000000032F1000-memory.dmp

              Filesize

              4KB

            • memory/3772-0-0x0000000000400000-0x00000000004A9000-memory.dmp

              Filesize

              676KB

            • memory/3772-21-0x00000000032E0000-0x00000000032E1000-memory.dmp

              Filesize

              4KB

            • memory/3772-43-0x00000000009A0000-0x00000000009F4000-memory.dmp

              Filesize

              336KB

            • memory/3772-42-0x0000000000400000-0x00000000004A9000-memory.dmp

              Filesize

              676KB

            • memory/3772-22-0x00000000032E0000-0x00000000032E1000-memory.dmp

              Filesize

              4KB

            • memory/3772-2-0x0000000002230000-0x0000000002231000-memory.dmp

              Filesize

              4KB

            • memory/3772-38-0x00000000032E0000-0x00000000033E0000-memory.dmp

              Filesize

              1024KB

            • memory/3772-36-0x00000000032E0000-0x00000000033E0000-memory.dmp

              Filesize

              1024KB

            • memory/3772-34-0x00000000032E0000-0x00000000033E0000-memory.dmp

              Filesize

              1024KB

            • memory/3772-20-0x00000000032E0000-0x00000000032E1000-memory.dmp

              Filesize

              4KB

            • memory/3772-56-0x00000000032E0000-0x00000000033E0000-memory.dmp

              Filesize

              1024KB

            • memory/3772-33-0x00000000032E0000-0x00000000033E0000-memory.dmp

              Filesize

              1024KB

            • memory/3772-32-0x00000000032E0000-0x00000000033E0000-memory.dmp

              Filesize

              1024KB

            • memory/3772-31-0x00000000032E0000-0x00000000033E0000-memory.dmp

              Filesize

              1024KB

            • memory/3772-28-0x00000000032E0000-0x00000000033E0000-memory.dmp

              Filesize

              1024KB

            • memory/3772-27-0x00000000032E0000-0x00000000033E0000-memory.dmp

              Filesize

              1024KB

            • memory/3772-26-0x00000000032E0000-0x00000000033E0000-memory.dmp

              Filesize

              1024KB

            • memory/3772-4-0x0000000002370000-0x0000000002371000-memory.dmp

              Filesize

              4KB

            • memory/3772-6-0x00000000021E0000-0x00000000021E1000-memory.dmp

              Filesize

              4KB

            • memory/3772-87-0x00000000032E0000-0x00000000033E0000-memory.dmp

              Filesize

              1024KB

            • memory/3772-5-0x00000000021F0000-0x00000000021F1000-memory.dmp

              Filesize

              4KB

            • memory/3772-11-0x00000000032E0000-0x000000000331A000-memory.dmp

              Filesize

              232KB

            • memory/3772-7-0x0000000002360000-0x0000000002361000-memory.dmp

              Filesize

              4KB

            • memory/3772-8-0x0000000002350000-0x0000000002351000-memory.dmp

              Filesize

              4KB

            • memory/3772-9-0x0000000002380000-0x0000000002381000-memory.dmp

              Filesize

              4KB

            • memory/3772-10-0x0000000002200000-0x0000000002201000-memory.dmp

              Filesize

              4KB

            • memory/3772-1-0x00000000009A0000-0x00000000009F4000-memory.dmp

              Filesize

              336KB