Analysis
-
max time kernel
117s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
25/08/2024, 06:56
Static task
static1
Behavioral task
behavioral1
Sample
c0303c8fba00b5ce0737a67a5e560666_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
c0303c8fba00b5ce0737a67a5e560666_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
c0303c8fba00b5ce0737a67a5e560666_JaffaCakes118.dll
-
Size
115KB
-
MD5
c0303c8fba00b5ce0737a67a5e560666
-
SHA1
68a910e517d705d0917c7865d9e501f819ce188e
-
SHA256
0c011a19096b8d46b6e3c194c3d077fe13fe0c4a1a7d9cd4ed7b0f19e4a30607
-
SHA512
d4ecc951a2a45ed410d265056315d7cbd496c691b01042fbad50ed6e32f3ca2546554530c94401eead7cb9e5154b80b86998559da7acb3d8fa964837f3b1a9f5
-
SSDEEP
3072:olwTw7eGSmz6u137IdXQsyjCEwDCu7N92TXF8GZurI:jceQXcXhaSGZ
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\usnscv = "\"C:\\Users\\Admin\\AppData\\Roaming\\usnscv.exe \"" reg.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry key 1 TTPs 1 IoCs
pid Process 2784 reg.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2400 rundll32.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2400 rundll32.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 2544 wrote to memory of 2400 2544 rundll32.exe 30 PID 2544 wrote to memory of 2400 2544 rundll32.exe 30 PID 2544 wrote to memory of 2400 2544 rundll32.exe 30 PID 2544 wrote to memory of 2400 2544 rundll32.exe 30 PID 2544 wrote to memory of 2400 2544 rundll32.exe 30 PID 2544 wrote to memory of 2400 2544 rundll32.exe 30 PID 2544 wrote to memory of 2400 2544 rundll32.exe 30 PID 2400 wrote to memory of 1732 2400 rundll32.exe 31 PID 2400 wrote to memory of 1732 2400 rundll32.exe 31 PID 2400 wrote to memory of 1732 2400 rundll32.exe 31 PID 2400 wrote to memory of 1732 2400 rundll32.exe 31 PID 2400 wrote to memory of 1732 2400 rundll32.exe 31 PID 2400 wrote to memory of 1732 2400 rundll32.exe 31 PID 2400 wrote to memory of 1732 2400 rundll32.exe 31 PID 1732 wrote to memory of 1940 1732 cmd.exe 33 PID 1732 wrote to memory of 1940 1732 cmd.exe 33 PID 1732 wrote to memory of 1940 1732 cmd.exe 33 PID 1732 wrote to memory of 1940 1732 cmd.exe 33 PID 1940 wrote to memory of 2784 1940 cmd.exe 34 PID 1940 wrote to memory of 2784 1940 cmd.exe 34 PID 1940 wrote to memory of 2784 1940 cmd.exe 34 PID 1940 wrote to memory of 2784 1940 cmd.exe 34
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c0303c8fba00b5ce0737a67a5e560666_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c0303c8fba00b5ce0737a67a5e560666_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Windows\SysWOW64\cmd.execmd /c setup.bat3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /V usnscv /D "\"C:\Users\Admin\AppData\Roaming\usnscv.exe \"" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\SysWOW64\reg.exeREG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /V usnscv /D "\"C:\Users\Admin\AppData\Roaming\usnscv.exe \"" /f5⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2784
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
147B
MD5ff9d19a15222e7ecf65ebf0442a5ead1
SHA1abd8960adca68c5f1e49734e034c1ebed5000e95
SHA256873405790f4c7ac4b031be8b9bab98f56fbe13de07b2576a832e19ade31e135b
SHA512392c5f9178577f00ee2e42d5c16834c006f75b28d8695c79dbdd34cde89d01b2d982b470ddb7f239ae1eb6ddfa646c060c7951224b88382d0b9ff7dea4b86af0