Analysis
-
max time kernel
135s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25/08/2024, 06:56
Static task
static1
Behavioral task
behavioral1
Sample
c0303c8fba00b5ce0737a67a5e560666_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
c0303c8fba00b5ce0737a67a5e560666_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
c0303c8fba00b5ce0737a67a5e560666_JaffaCakes118.dll
-
Size
115KB
-
MD5
c0303c8fba00b5ce0737a67a5e560666
-
SHA1
68a910e517d705d0917c7865d9e501f819ce188e
-
SHA256
0c011a19096b8d46b6e3c194c3d077fe13fe0c4a1a7d9cd4ed7b0f19e4a30607
-
SHA512
d4ecc951a2a45ed410d265056315d7cbd496c691b01042fbad50ed6e32f3ca2546554530c94401eead7cb9e5154b80b86998559da7acb3d8fa964837f3b1a9f5
-
SSDEEP
3072:olwTw7eGSmz6u137IdXQsyjCEwDCu7N92TXF8GZurI:jceQXcXhaSGZ
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\usnscv = "\"C:\\Users\\Admin\\AppData\\Roaming\\usnscv.exe \"" reg.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe -
Modifies registry key 1 TTPs 1 IoCs
pid Process 3972 reg.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 3556 rundll32.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3556 rundll32.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1844 wrote to memory of 3556 1844 rundll32.exe 87 PID 1844 wrote to memory of 3556 1844 rundll32.exe 87 PID 1844 wrote to memory of 3556 1844 rundll32.exe 87 PID 3556 wrote to memory of 1860 3556 rundll32.exe 88 PID 3556 wrote to memory of 1860 3556 rundll32.exe 88 PID 3556 wrote to memory of 1860 3556 rundll32.exe 88 PID 1860 wrote to memory of 1272 1860 cmd.exe 90 PID 1860 wrote to memory of 1272 1860 cmd.exe 90 PID 1860 wrote to memory of 1272 1860 cmd.exe 90 PID 1272 wrote to memory of 3972 1272 cmd.exe 91 PID 1272 wrote to memory of 3972 1272 cmd.exe 91 PID 1272 wrote to memory of 3972 1272 cmd.exe 91
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c0303c8fba00b5ce0737a67a5e560666_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c0303c8fba00b5ce0737a67a5e560666_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c setup.bat3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /V usnscv /D "\"C:\Users\Admin\AppData\Roaming\usnscv.exe \"" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Windows\SysWOW64\reg.exeREG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /V usnscv /D "\"C:\Users\Admin\AppData\Roaming\usnscv.exe \"" /f5⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:3972
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
147B
MD5ff9d19a15222e7ecf65ebf0442a5ead1
SHA1abd8960adca68c5f1e49734e034c1ebed5000e95
SHA256873405790f4c7ac4b031be8b9bab98f56fbe13de07b2576a832e19ade31e135b
SHA512392c5f9178577f00ee2e42d5c16834c006f75b28d8695c79dbdd34cde89d01b2d982b470ddb7f239ae1eb6ddfa646c060c7951224b88382d0b9ff7dea4b86af0