7fbdf086653e35df4484aaf3cd036e0fccacfb6d73b2da86084967b8759147e2

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25-08-2024 00:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bfc1c5c40476d91bcebae28ecaf43f36_JaffaCakes118.exe
Size

57KB
MD5

bfc1c5c40476d91bcebae28ecaf43f36
SHA1

eb42cb53ec34896715d3865aa4d38264159a534b
SHA256

7fbdf086653e35df4484aaf3cd036e0fccacfb6d73b2da86084967b8759147e2
SHA512

55faf54ee9561bc79d8dfac9bbe54e1a5c4c8b87fe629b61f0fad0a42246237f837f0a0fdb942fdab777ab271a9672e921e66688db983c08675de10168bac5ee
SSDEEP

1536:w6Jz6+PtawWCVk52lG01bDmHxNZ7hmWYiJfQNiecoN9F/XZ8El0x:YItRkEjANZ74Mjecox/JL0x

Score

10^/10

discovery evasion persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\e5772af.exe\""	bfc1c5c40476d91bcebae28ecaf43f36_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\e5772af.exe\""	bfc1c5c40476d91bcebae28ecaf43f36_JaffaCakes118.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	bfc1c5c40476d91bcebae28ecaf43f36_JaffaCakes118.exe

Disables Task Manager via registry modification
evasion

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e5772af.exe	bfc1c5c40476d91bcebae28ecaf43f36_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e5772af.exe	bfc1c5c40476d91bcebae28ecaf43f36_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e5772af.exe	e5772af.exe

Executes dropped EXE 2 IoCs

pid	Process
1112	e5772af.exe
3240	e5772af.exe

Loads dropped DLL 1 IoCs

pid	Process
3240	e5772af.exe

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2456-0-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/memory/4504-3-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral2/memory/4504-5-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral2/memory/2456-7-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/memory/4504-9-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral2/memory/4504-8-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral2/files/0x0007000000022aa5-12.dat	upx
behavioral2/memory/4504-13-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral2/memory/1112-25-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/memory/3240-21-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral2/memory/3240-26-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral2/memory/3240-22-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral2/memory/3240-29-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral2/memory/3240-39-0x0000000000400000-0x0000000000422000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\OMdi3n9h2uc = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\e5772af.exe\""	bfc1c5c40476d91bcebae28ecaf43f36_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OMdi3n9h2uc = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\e5772af.exe\""	bfc1c5c40476d91bcebae28ecaf43f36_JaffaCakes118.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2456 set thread context of 4504	2456	bfc1c5c40476d91bcebae28ecaf43f36_JaffaCakes118.exe	84
PID 1112 set thread context of 3240	1112	e5772af.exe	86

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bfc1c5c40476d91bcebae28ecaf43f36_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e5772af.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e5772af.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bfc1c5c40476d91bcebae28ecaf43f36_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
940	ipconfig.exe

Kills process with taskkill 6 IoCs

evasion

pid	Process
4140	taskkill.exe
3552	taskkill.exe
4780	taskkill.exe
4732	taskkill.exe
3556	taskkill.exe
2704	taskkill.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	4140	taskkill.exe
Token: SeDebugPrivilege	3552	taskkill.exe
Token: SeDebugPrivilege	4780	taskkill.exe
Token: SeDebugPrivilege	4732	taskkill.exe
Token: SeDebugPrivilege	3556	taskkill.exe
Token: SeDebugPrivilege	2704	taskkill.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2456	bfc1c5c40476d91bcebae28ecaf43f36_JaffaCakes118.exe
1112	e5772af.exe
3240	e5772af.exe
3240	e5772af.exe
3240	e5772af.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 2456 wrote to memory of 4504	2456	bfc1c5c40476d91bcebae28ecaf43f36_JaffaCakes118.exe	84
PID 2456 wrote to memory of 4504	2456	bfc1c5c40476d91bcebae28ecaf43f36_JaffaCakes118.exe	84
PID 2456 wrote to memory of 4504	2456	bfc1c5c40476d91bcebae28ecaf43f36_JaffaCakes118.exe	84
PID 2456 wrote to memory of 4504	2456	bfc1c5c40476d91bcebae28ecaf43f36_JaffaCakes118.exe	84
PID 2456 wrote to memory of 4504	2456	bfc1c5c40476d91bcebae28ecaf43f36_JaffaCakes118.exe	84
PID 2456 wrote to memory of 4504	2456	bfc1c5c40476d91bcebae28ecaf43f36_JaffaCakes118.exe	84
PID 2456 wrote to memory of 4504	2456	bfc1c5c40476d91bcebae28ecaf43f36_JaffaCakes118.exe	84
PID 2456 wrote to memory of 4504	2456	bfc1c5c40476d91bcebae28ecaf43f36_JaffaCakes118.exe	84
PID 4504 wrote to memory of 1112	4504	bfc1c5c40476d91bcebae28ecaf43f36_JaffaCakes118.exe	85
PID 4504 wrote to memory of 1112	4504	bfc1c5c40476d91bcebae28ecaf43f36_JaffaCakes118.exe	85
PID 4504 wrote to memory of 1112	4504	bfc1c5c40476d91bcebae28ecaf43f36_JaffaCakes118.exe	85
PID 1112 wrote to memory of 3240	1112	e5772af.exe	86
PID 1112 wrote to memory of 3240	1112	e5772af.exe	86
PID 1112 wrote to memory of 3240	1112	e5772af.exe	86
PID 1112 wrote to memory of 3240	1112	e5772af.exe	86
PID 1112 wrote to memory of 3240	1112	e5772af.exe	86
PID 1112 wrote to memory of 3240	1112	e5772af.exe	86
PID 1112 wrote to memory of 3240	1112	e5772af.exe	86
PID 1112 wrote to memory of 3240	1112	e5772af.exe	86
PID 3240 wrote to memory of 940	3240	e5772af.exe	87
PID 3240 wrote to memory of 940	3240	e5772af.exe	87
PID 3240 wrote to memory of 940	3240	e5772af.exe	87
PID 3240 wrote to memory of 4140	3240	e5772af.exe	88
PID 3240 wrote to memory of 4140	3240	e5772af.exe	88
PID 3240 wrote to memory of 4140	3240	e5772af.exe	88
PID 3240 wrote to memory of 3552	3240	e5772af.exe	95
PID 3240 wrote to memory of 3552	3240	e5772af.exe	95
PID 3240 wrote to memory of 3552	3240	e5772af.exe	95
PID 3240 wrote to memory of 4780	3240	e5772af.exe	97
PID 3240 wrote to memory of 4780	3240	e5772af.exe	97
PID 3240 wrote to memory of 4780	3240	e5772af.exe	97
PID 3240 wrote to memory of 4732	3240	e5772af.exe	99
PID 3240 wrote to memory of 4732	3240	e5772af.exe	99
PID 3240 wrote to memory of 4732	3240	e5772af.exe	99
PID 3240 wrote to memory of 3556	3240	e5772af.exe	101
PID 3240 wrote to memory of 3556	3240	e5772af.exe	101
PID 3240 wrote to memory of 3556	3240	e5772af.exe	101
PID 3240 wrote to memory of 2704	3240	e5772af.exe	105
PID 3240 wrote to memory of 2704	3240	e5772af.exe	105
PID 3240 wrote to memory of 2704	3240	e5772af.exe	105

C:\Users\Admin\AppData\Local\Temp\bfc1c5c40476d91bcebae28ecaf43f36_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\bfc1c5c40476d91bcebae28ecaf43f36_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Users\Admin\AppData\Local\Temp\bfc1c5c40476d91bcebae28ecaf43f36_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\bfc1c5c40476d91bcebae28ecaf43f36_JaffaCakes118.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Disables RegEdit via registry modification
  - Drops startup file
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4504
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e5772af.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e5772af.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1112
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e5772af.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e5772af.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3240
    - - C:\Windows\SysWOW64\ipconfig.exe
        
        ipconfig /flushdns && ipconfig /renew
        5⤵
        System Location Discovery: System Language Discovery
        Gathers network information
        
        PID:940
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im explorer.exe
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4140
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im explorer.exe
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3552
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im explorer.exe
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4780
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im explorer.exe
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4732
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im explorer.exe
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3556
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im explorer.exe
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e5772af.exe

Filesize
57KB

MD5
bfc1c5c40476d91bcebae28ecaf43f36

SHA1
eb42cb53ec34896715d3865aa4d38264159a534b

SHA256
7fbdf086653e35df4484aaf3cd036e0fccacfb6d73b2da86084967b8759147e2

SHA512
55faf54ee9561bc79d8dfac9bbe54e1a5c4c8b87fe629b61f0fad0a42246237f837f0a0fdb942fdab777ab271a9672e921e66688db983c08675de10168bac5ee

Download Submit
C:\Users\Admin\AppData\Roaming\k6.dll

Filesize
3KB

MD5
e9032dac10fb27acfa89c3357fad86b3

SHA1
1623843e0d369c9911989c0730a6470c22dd60fd

SHA256
9de0bb4cb8a79f575da4dbc86cedb6a9ef8d94c0b176fd4690b9b7ffee078391

SHA512
70e663ad1e87832673f7140aca20dcd3db46c256b91f2924e7a9e1ab24a295d432b625fdcc53b1f3bbc84f91390190e4bd483da5285f95ed0316be09b2b82004

Download Submit
memory/1112-25-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2456-7-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2456-0-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3240-21-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/3240-26-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/3240-22-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/3240-29-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/3240-39-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/4504-9-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/4504-8-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/4504-13-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/4504-5-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/4504-3-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads