d22f6da32739e853b19d08aac76984019c0cda0afd68fd93161a2b83a11888fa

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/08/2024, 10:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b30950e72f493a795937f45668a3f66b_JaffaCakes118.exe
Size

88KB
MD5

b30950e72f493a795937f45668a3f66b
SHA1

9526d68f8a1f76756e7bba5178e4067a0ab03ac8
SHA256

d22f6da32739e853b19d08aac76984019c0cda0afd68fd93161a2b83a11888fa
SHA512

63250c14774f4645fdad422224fe80bff9a91c5cf1245c5ff8a1e493a02bddfe46e02539f59325eb9fa8f995647378230fab2d2c441b320f4e06b59c27d9d839
SSDEEP

1536:SRvS1b1o7v/aY/mJ6sABc1ITEINSBfxToO6o:KSJ1ozpOwsABMTh6o

Score

8^/10

discovery persistence

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	svchost.exe
File created	C:\Windows\system32\drivers\etc\newhost.txt	svchost.exe

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Applocale\Parameters\ServiceDll = "%SystemRoot%\\system32\\Applocale.dll"	b30950e72f493a795937f45668a3f66b_JaffaCakes118.exe

Loads dropped DLL 1 IoCs

pid	Process
2968	svchost.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Applocale.dll	b30950e72f493a795937f45668a3f66b_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b30950e72f493a795937f45668a3f66b_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2228	b30950e72f493a795937f45668a3f66b_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 2328	2228	b30950e72f493a795937f45668a3f66b_JaffaCakes118.exe	85
PID 2228 wrote to memory of 2328	2228	b30950e72f493a795937f45668a3f66b_JaffaCakes118.exe	85
PID 2228 wrote to memory of 2328	2228	b30950e72f493a795937f45668a3f66b_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\b30950e72f493a795937f45668a3f66b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b30950e72f493a795937f45668a3f66b_JaffaCakes118.exe"
1⤵
- Server Software Component: Terminal Services DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\B30950~1.EXE > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2328

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Applocale.dll

Filesize
56KB

MD5
118a2d5ecf45bddde9aa780e5e20ce0a

SHA1
c324554233ab69a1bf76bf7b52a3815822281ae9

SHA256
92fa27c15dc608ff2fc26472289c0acacf26155d0aa3e9d38f69257ca3680a02

SHA512
0a23ca3fe43fdfb1c96ce86d68e3950dd55efdbdcc4890aba8507633097a4f1ead653abddc9b653856d93b5693b31f1eceb5b179560bfcd781bc62a209352725

Download Submit
C:\Windows\System32\drivers\etc\newhost.txt

Filesize
1KB

MD5
008fba141529811128b8cd5f52300f6e

SHA1
1a350b35d82cb4bd7a924b6840c36a678105f793

SHA256
ab0e454a786ef19a3ae1337f10f47354ffa9521ea5026e9e11174eca22d86e84

SHA512
80189560b6cf180a9c1ecafc90018b48541687f52f5d49b54ca25e040b3264da053e3d4dbb0cd38caaf496e23e516de18f500b333e3cda1fd1b25c6e9632defc

Download Submit