0e0abf6a84acbfa33e6f2a1976b70d99193ad4b97392aaa8f0217b078a850341

Analysis

max time kernel
150s
max time network
137s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
25/08/2024, 15:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c10232fdeaa433a18feadb06ab6d4a23_JaffaCakes118.exe
Size

183KB
MD5

c10232fdeaa433a18feadb06ab6d4a23
SHA1

996078d80e0ddc650abc3e18d6cdbff900a2b64e
SHA256

0e0abf6a84acbfa33e6f2a1976b70d99193ad4b97392aaa8f0217b078a850341
SHA512

72c83fd2f4579ae9bae1c3e9c85af6916dbe69e27c97d2029642cb836ad3b0725044ae8813c755543bbdd45115643d9312d484b79d4c76661782a2e813ec3ac6
SSDEEP

3072:tTgmjJyZ4eDSEX4xrJuKdo5memMQvkXpyYYGMbc8tmlx4IOqr9VCQ0ThYZ4kboh:tT/jwa4n0emhkphnic8tmbOqJgNE

Score

7^/10

discovery persistence upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2064	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2108	seumi.exe

Loads dropped DLL 2 IoCs

pid	Process
2476	c10232fdeaa433a18feadb06ab6d4a23_JaffaCakes118.exe
2476	c10232fdeaa433a18feadb06ab6d4a23_JaffaCakes118.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2476-0-0x0000000000400000-0x00000000027C0000-memory.dmp	upx
behavioral1/files/0x00090000000173c2-5.dat	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\{15320D28-6FEE-AD4F-3AAA-40C7281D63DA} = "C:\\Users\\Admin\\AppData\\Roaming\\Utivwa\\seumi.exe"	seumi.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2476 set thread context of 2064	2476	c10232fdeaa433a18feadb06ab6d4a23_JaffaCakes118.exe	31

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c10232fdeaa433a18feadb06ab6d4a23_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Privacy	c10232fdeaa433a18feadb06ab6d4a23_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0"	c10232fdeaa433a18feadb06ab6d4a23_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
2108	seumi.exe
2108	seumi.exe
2108	seumi.exe
2108	seumi.exe
2108	seumi.exe
2108	seumi.exe
2108	seumi.exe
2108	seumi.exe
2108	seumi.exe
2108	seumi.exe
2108	seumi.exe
2108	seumi.exe
2108	seumi.exe
2108	seumi.exe
2108	seumi.exe
2108	seumi.exe
2108	seumi.exe
2108	seumi.exe
2108	seumi.exe
2108	seumi.exe
2108	seumi.exe
2108	seumi.exe
2108	seumi.exe
2108	seumi.exe
2108	seumi.exe
2108	seumi.exe
2108	seumi.exe
2108	seumi.exe
2108	seumi.exe
2108	seumi.exe
2108	seumi.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeSecurityPrivilege	2476	c10232fdeaa433a18feadb06ab6d4a23_JaffaCakes118.exe
Token: SeSecurityPrivilege	2476	c10232fdeaa433a18feadb06ab6d4a23_JaffaCakes118.exe
Token: SeSecurityPrivilege	2476	c10232fdeaa433a18feadb06ab6d4a23_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 2108	2476	c10232fdeaa433a18feadb06ab6d4a23_JaffaCakes118.exe	30
PID 2476 wrote to memory of 2108	2476	c10232fdeaa433a18feadb06ab6d4a23_JaffaCakes118.exe	30
PID 2476 wrote to memory of 2108	2476	c10232fdeaa433a18feadb06ab6d4a23_JaffaCakes118.exe	30
PID 2476 wrote to memory of 2108	2476	c10232fdeaa433a18feadb06ab6d4a23_JaffaCakes118.exe	30
PID 2108 wrote to memory of 1112	2108	seumi.exe	19
PID 2108 wrote to memory of 1112	2108	seumi.exe	19
PID 2108 wrote to memory of 1112	2108	seumi.exe	19
PID 2108 wrote to memory of 1112	2108	seumi.exe	19
PID 2108 wrote to memory of 1112	2108	seumi.exe	19
PID 2108 wrote to memory of 1164	2108	seumi.exe	20
PID 2108 wrote to memory of 1164	2108	seumi.exe	20
PID 2108 wrote to memory of 1164	2108	seumi.exe	20
PID 2108 wrote to memory of 1164	2108	seumi.exe	20
PID 2108 wrote to memory of 1164	2108	seumi.exe	20
PID 2108 wrote to memory of 1200	2108	seumi.exe	21
PID 2108 wrote to memory of 1200	2108	seumi.exe	21
PID 2108 wrote to memory of 1200	2108	seumi.exe	21
PID 2108 wrote to memory of 1200	2108	seumi.exe	21
PID 2108 wrote to memory of 1200	2108	seumi.exe	21
PID 2108 wrote to memory of 336	2108	seumi.exe	25
PID 2108 wrote to memory of 336	2108	seumi.exe	25
PID 2108 wrote to memory of 336	2108	seumi.exe	25
PID 2108 wrote to memory of 336	2108	seumi.exe	25
PID 2108 wrote to memory of 336	2108	seumi.exe	25
PID 2108 wrote to memory of 2476	2108	seumi.exe	29
PID 2108 wrote to memory of 2476	2108	seumi.exe	29
PID 2108 wrote to memory of 2476	2108	seumi.exe	29
PID 2108 wrote to memory of 2476	2108	seumi.exe	29
PID 2108 wrote to memory of 2476	2108	seumi.exe	29
PID 2476 wrote to memory of 2064	2476	c10232fdeaa433a18feadb06ab6d4a23_JaffaCakes118.exe	31
PID 2476 wrote to memory of 2064	2476	c10232fdeaa433a18feadb06ab6d4a23_JaffaCakes118.exe	31
PID 2476 wrote to memory of 2064	2476	c10232fdeaa433a18feadb06ab6d4a23_JaffaCakes118.exe	31
PID 2476 wrote to memory of 2064	2476	c10232fdeaa433a18feadb06ab6d4a23_JaffaCakes118.exe	31
PID 2476 wrote to memory of 2064	2476	c10232fdeaa433a18feadb06ab6d4a23_JaffaCakes118.exe	31
PID 2476 wrote to memory of 2064	2476	c10232fdeaa433a18feadb06ab6d4a23_JaffaCakes118.exe	31
PID 2476 wrote to memory of 2064	2476	c10232fdeaa433a18feadb06ab6d4a23_JaffaCakes118.exe	31
PID 2476 wrote to memory of 2064	2476	c10232fdeaa433a18feadb06ab6d4a23_JaffaCakes118.exe	31
PID 2476 wrote to memory of 2064	2476	c10232fdeaa433a18feadb06ab6d4a23_JaffaCakes118.exe	31

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1112

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1164

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1200
- C:\Users\Admin\AppData\Local\Temp\c10232fdeaa433a18feadb06ab6d4a23_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c10232fdeaa433a18feadb06ab6d4a23_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2476
- - C:\Users\Admin\AppData\Roaming\Utivwa\seumi.exe
    "C:\Users\Admin\AppData\Roaming\Utivwa\seumi.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2108
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp5277afe1.bat"
    3⤵
    - Deletes itself
    - System Location Discovery: System Language Discovery
    PID:2064

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp5277afe1.bat

Filesize
271B

MD5
b6e61104541a2d95749daaf5900b0df8

SHA1
1a05ae95c1de72b8de421a94ffad830b3cb2e315

SHA256
e72bb88e1b728bbeca79feef65e4687ac41d68e11a8f7e95edf4f38caf4e6f40

SHA512
674b4f00719120e69477b612372a9226fc4f0f992f273345c46390214a89a643a785b753f05ab4a5c3de1065b6331ceb6682469444295ef83e8f44c4717eb77a

Download Submit
C:\Users\Admin\AppData\Roaming\Kyfe\ejva.erq

Filesize
380B

MD5
b4a13120b64780d20e4af6d1f755e166

SHA1
381777f06719e2235396e18d06b995b507975817

SHA256
40e8ca0a83b5f43b328fc17c6307024a77ab964e399998ccaf2d6acc14638afa

SHA512
507d1795f2b266def4706f647208dcee24ec2109fe42790cf38e377559ca5f9c51d02e8556515958ced7f84811b4411cc23ced23748ee4caac3e5125acb09bbf

Download Submit
\Users\Admin\AppData\Roaming\Utivwa\seumi.exe

Filesize
183KB

MD5
27836e3460bac7ed9eb2970645fbf419

SHA1
c7d8735dcfa03c626ea033ab5161f58a4056c02d

SHA256
726d1a68fa9ab683a3dc1d0edfa4d9983cc4a3ed98f284866db3baf1430a46dd

SHA512
471628dd4040e725a5680f3ab76f246786ff31b5436f2e0bf1ec6a328cc0ab5fbbf7747f2132ce736115a35a4a6ec6704a161368c0da9ff4c62cf9e5e9826406

Download Submit
memory/336-52-0x0000000001ED0000-0x0000000001F05000-memory.dmp

Filesize
212KB

Download
memory/336-46-0x0000000001ED0000-0x0000000001F05000-memory.dmp

Filesize
212KB

Download
memory/336-48-0x0000000001ED0000-0x0000000001F05000-memory.dmp

Filesize
212KB

Download
memory/336-50-0x0000000001ED0000-0x0000000001F05000-memory.dmp

Filesize
212KB

Download
memory/1112-14-0x0000000002220000-0x0000000002255000-memory.dmp

Filesize
212KB

Download
memory/1112-16-0x0000000002220000-0x0000000002255000-memory.dmp

Filesize
212KB

Download
memory/1112-18-0x0000000002220000-0x0000000002255000-memory.dmp

Filesize
212KB

Download
memory/1112-20-0x0000000002220000-0x0000000002255000-memory.dmp

Filesize
212KB

Download
memory/1112-22-0x0000000002220000-0x0000000002255000-memory.dmp

Filesize
212KB

Download
memory/1164-28-0x0000000001EA0000-0x0000000001ED5000-memory.dmp

Filesize
212KB

Download
memory/1164-26-0x0000000001EA0000-0x0000000001ED5000-memory.dmp

Filesize
212KB

Download
memory/1164-30-0x0000000001EA0000-0x0000000001ED5000-memory.dmp

Filesize
212KB

Download
memory/1164-32-0x0000000001EA0000-0x0000000001ED5000-memory.dmp

Filesize
212KB

Download
memory/1200-42-0x00000000024C0000-0x00000000024F5000-memory.dmp

Filesize
212KB

Download
memory/1200-36-0x00000000024C0000-0x00000000024F5000-memory.dmp

Filesize
212KB

Download
memory/1200-38-0x00000000024C0000-0x00000000024F5000-memory.dmp

Filesize
212KB

Download
memory/1200-40-0x00000000024C0000-0x00000000024F5000-memory.dmp

Filesize
212KB

Download
memory/2476-69-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download
memory/2476-73-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download
memory/2476-64-0x0000000000280000-0x00000000002B5000-memory.dmp

Filesize
212KB

Download
memory/2476-67-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download
memory/2476-65-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download
memory/2476-58-0x0000000000280000-0x00000000002B5000-memory.dmp

Filesize
212KB

Download
memory/2476-60-0x0000000000280000-0x00000000002B5000-memory.dmp

Filesize
212KB

Download
memory/2476-0-0x0000000000400000-0x00000000027C0000-memory.dmp

Filesize
35.8MB

Download
memory/2476-62-0x0000000000280000-0x00000000002B5000-memory.dmp

Filesize
212KB

Download
memory/2476-71-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download
memory/2476-75-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download
memory/2476-77-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download
memory/2476-56-0x0000000000280000-0x00000000002B5000-memory.dmp

Filesize
212KB

Download
memory/2476-1-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2476-195-0x0000000000400000-0x00000000027C0000-memory.dmp

Filesize
35.8MB

Download
memory/2476-2-0x0000000000412000-0x0000000000413000-memory.dmp

Filesize
4KB

Download
memory/2476-12-0x0000000000400000-0x00000000027C0000-memory.dmp

Filesize
35.8MB

Download