Analysis

  • max time kernel
    135s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/08/2024, 06:56

General

  • Target

    c0303c8fba00b5ce0737a67a5e560666_JaffaCakes118.dll

  • Size

    115KB

  • MD5

    c0303c8fba00b5ce0737a67a5e560666

  • SHA1

    68a910e517d705d0917c7865d9e501f819ce188e

  • SHA256

    0c011a19096b8d46b6e3c194c3d077fe13fe0c4a1a7d9cd4ed7b0f19e4a30607

  • SHA512

    d4ecc951a2a45ed410d265056315d7cbd496c691b01042fbad50ed6e32f3ca2546554530c94401eead7cb9e5154b80b86998559da7acb3d8fa964837f3b1a9f5

  • SSDEEP

    3072:olwTw7eGSmz6u137IdXQsyjCEwDCu7N92TXF8GZurI:jceQXcXhaSGZ

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\c0303c8fba00b5ce0737a67a5e560666_JaffaCakes118.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1844
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\c0303c8fba00b5ce0737a67a5e560666_JaffaCakes118.dll,#1
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3556
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c setup.bat
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1860
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /V usnscv /D "\"C:\Users\Admin\AppData\Roaming\usnscv.exe \"" /f
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1272
          • C:\Windows\SysWOW64\reg.exe
            REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /V usnscv /D "\"C:\Users\Admin\AppData\Roaming\usnscv.exe \"" /f
            5⤵
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Modifies registry key
            PID:3972

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\setup.bat

          Filesize

          147B

          MD5

          ff9d19a15222e7ecf65ebf0442a5ead1

          SHA1

          abd8960adca68c5f1e49734e034c1ebed5000e95

          SHA256

          873405790f4c7ac4b031be8b9bab98f56fbe13de07b2576a832e19ade31e135b

          SHA512

          392c5f9178577f00ee2e42d5c16834c006f75b28d8695c79dbdd34cde89d01b2d982b470ddb7f239ae1eb6ddfa646c060c7951224b88382d0b9ff7dea4b86af0