537f8fa17e5db10bd9a1fb6260a2256dc3904b8d64bac8e84c59ab8dbee68434

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
25-08-2024 08:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c06294e0556984c8c9dcb5b0ceaced00_JaffaCakes118.exe
Size

17KB
MD5

c06294e0556984c8c9dcb5b0ceaced00
SHA1

da74999a7180ed77522dab81a2a53edfa9b26ac4
SHA256

537f8fa17e5db10bd9a1fb6260a2256dc3904b8d64bac8e84c59ab8dbee68434
SHA512

30515436d6a53b67440cf4ce0d264e69f50cac469a36fbdea08a0ccc1014fc571fbc9207bb26b69f7f11d0dfe12b19ad9a243148e19db399cbff1b05b2aea738
SSDEEP

384:2z6Xf2IDg3GwhEH6VJHvopICpWtsmkSo/Y2SYPi:RPsLEHMBvhCpWtXkSo/Y2xPi

Score

8^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\msosmsfpfis64.sys	c06294e0556984c8c9dcb5b0ceaced00_JaffaCakes118.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Deletes itself 1 IoCs

pid	Process
2612	cmd.exe

Loads dropped DLL 1 IoCs

pid	Process
1820	c06294e0556984c8c9dcb5b0ceaced00_JaffaCakes118.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\msosmnsf00.dll	c06294e0556984c8c9dcb5b0ceaced00_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\msosmnsf00.dll	c06294e0556984c8c9dcb5b0ceaced00_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\msosmnsf.dat	c06294e0556984c8c9dcb5b0ceaced00_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\win.ini	c06294e0556984c8c9dcb5b0ceaced00_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c06294e0556984c8c9dcb5b0ceaced00_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1820	c06294e0556984c8c9dcb5b0ceaced00_JaffaCakes118.exe
1820	c06294e0556984c8c9dcb5b0ceaced00_JaffaCakes118.exe
1820	c06294e0556984c8c9dcb5b0ceaced00_JaffaCakes118.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
472	services.exe
472	services.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1820	c06294e0556984c8c9dcb5b0ceaced00_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 1820 wrote to memory of 256	1820	c06294e0556984c8c9dcb5b0ceaced00_JaffaCakes118.exe	1
PID 1820 wrote to memory of 332	1820	c06294e0556984c8c9dcb5b0ceaced00_JaffaCakes118.exe	2
PID 1820 wrote to memory of 380	1820	c06294e0556984c8c9dcb5b0ceaced00_JaffaCakes118.exe	3
PID 1820 wrote to memory of 392	1820	c06294e0556984c8c9dcb5b0ceaced00_JaffaCakes118.exe	4
PID 1820 wrote to memory of 428	1820	c06294e0556984c8c9dcb5b0ceaced00_JaffaCakes118.exe	5
PID 1820 wrote to memory of 472	1820	c06294e0556984c8c9dcb5b0ceaced00_JaffaCakes118.exe	6
PID 1820 wrote to memory of 488	1820	c06294e0556984c8c9dcb5b0ceaced00_JaffaCakes118.exe	7
PID 1820 wrote to memory of 496	1820	c06294e0556984c8c9dcb5b0ceaced00_JaffaCakes118.exe	8
PID 1820 wrote to memory of 600	1820	c06294e0556984c8c9dcb5b0ceaced00_JaffaCakes118.exe	9
PID 1820 wrote to memory of 680	1820	c06294e0556984c8c9dcb5b0ceaced00_JaffaCakes118.exe	10
PID 1820 wrote to memory of 764	1820	c06294e0556984c8c9dcb5b0ceaced00_JaffaCakes118.exe	11
PID 1820 wrote to memory of 828	1820	c06294e0556984c8c9dcb5b0ceaced00_JaffaCakes118.exe	12
PID 1820 wrote to memory of 856	1820	c06294e0556984c8c9dcb5b0ceaced00_JaffaCakes118.exe	13
PID 1820 wrote to memory of 968	1820	c06294e0556984c8c9dcb5b0ceaced00_JaffaCakes118.exe	15
PID 1820 wrote to memory of 276	1820	c06294e0556984c8c9dcb5b0ceaced00_JaffaCakes118.exe	16
PID 1820 wrote to memory of 352	1820	c06294e0556984c8c9dcb5b0ceaced00_JaffaCakes118.exe	17
PID 1820 wrote to memory of 1060	1820	c06294e0556984c8c9dcb5b0ceaced00_JaffaCakes118.exe	18
PID 1820 wrote to memory of 1108	1820	c06294e0556984c8c9dcb5b0ceaced00_JaffaCakes118.exe	19
PID 1820 wrote to memory of 1164	1820	c06294e0556984c8c9dcb5b0ceaced00_JaffaCakes118.exe	20
PID 1820 wrote to memory of 1204	1820	c06294e0556984c8c9dcb5b0ceaced00_JaffaCakes118.exe	21
PID 1820 wrote to memory of 820	1820	c06294e0556984c8c9dcb5b0ceaced00_JaffaCakes118.exe	23
PID 1820 wrote to memory of 996	1820	c06294e0556984c8c9dcb5b0ceaced00_JaffaCakes118.exe	24
PID 1820 wrote to memory of 2880	1820	c06294e0556984c8c9dcb5b0ceaced00_JaffaCakes118.exe	25
PID 1820 wrote to memory of 2612	1820	c06294e0556984c8c9dcb5b0ceaced00_JaffaCakes118.exe	28
PID 1820 wrote to memory of 2612	1820	c06294e0556984c8c9dcb5b0ceaced00_JaffaCakes118.exe	28
PID 1820 wrote to memory of 2612	1820	c06294e0556984c8c9dcb5b0ceaced00_JaffaCakes118.exe	28
PID 1820 wrote to memory of 2612	1820	c06294e0556984c8c9dcb5b0ceaced00_JaffaCakes118.exe	28

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe
1⤵
PID:256

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:332

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:380
- C:\Windows\system32\services.exe
  C:\Windows\system32\services.exe
  2⤵
  - Suspicious behavior: LoadsDriver
  PID:472
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    3⤵
    PID:600
  - - C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
      4⤵
      PID:820
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    3⤵
    PID:680
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    3⤵
    PID:764
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    3⤵
    PID:828
  - - C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      4⤵
      PID:1164
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    3⤵
    PID:856
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService
    3⤵
    PID:968
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    3⤵
    PID:276
- - C:\Windows\System32\spoolsv.exe
    C:\Windows\System32\spoolsv.exe
    3⤵
    PID:352
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    3⤵
    PID:1060
- - C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    3⤵
    PID:1108
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    3⤵
    PID:996
- - C:\Windows\system32\sppsvc.exe
    C:\Windows\system32\sppsvc.exe
    3⤵
    PID:2880
- C:\Windows\system32\lsass.exe
  C:\Windows\system32\lsass.exe
  2⤵
  PID:488
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:496

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:392

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:428

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1204
- C:\Users\Admin\AppData\Local\Temp\c06294e0556984c8c9dcb5b0ceaced00_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c06294e0556984c8c9dcb5b0ceaced00_JaffaCakes118.exe"
  2⤵
  - Drops file in Drivers directory
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1820
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\c06294e0556984c8c9dcb5b0ceaced00_JaffaCakes118.exe"
    3⤵
    - Deletes itself
    - System Location Discovery: System Language Discovery
    PID:2612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\tmp8306.tmp

Filesize
12KB

MD5
5b51b6333dd8d943c6a411be2ee4430d

SHA1
3a2053beddc48d9ce44c3305052b25e5921b9543

SHA256
a666bbb99e511f162dba230f2b4e1f3dc1ecd5cbd9959e8142fcb995ee91c7cd

SHA512
72899d00a5f5e57b702a730c5a7a52636bf843873e4dee2b5c51b155014c8ac809bd5bdeac2e45c42d8c0530fb867a072f0416486294d8260f39915ba1a8ff7c

Download Submit
memory/256-10-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download
memory/256-13-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download
memory/1820-5-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download
memory/1820-87-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download