fe445373b3165ec2b6728ce8e95c72f77f80b786084e9bce2c00567e2967ded1

Analysis

max time kernel
140s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28/08/2024, 23:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c7d591d67eaef372ed375a0aaf2a0c76_JaffaCakes118.exe
Size

86KB
MD5

c7d591d67eaef372ed375a0aaf2a0c76
SHA1

d696553d1d8f1f800765958a2e9dec682d21a76c
SHA256

fe445373b3165ec2b6728ce8e95c72f77f80b786084e9bce2c00567e2967ded1
SHA512

060a03999123e3dccdd63476b750235be9a7d02cf690c041eed51789af45ecddac756b92b407530854e73d803baef26ecabf5adb45c19242da021853ad239a48
SSDEEP

1536:khJAP49cOw7Wi7TjGzyu/V5OCD/QL5P060axISYzC6wuEa:khOP4ecOjGzym1p60axTYzm6

Score

7^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1916	c7d591d67eaef372ed375a0aaf2a0c76_JaffaCakes118.exe

Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

Suspicious Windows Authentication Registry Modification.

persistence privilege_escalation

Authentication Package

T1547.002

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Notification Packages = 320064002e006f0063007800000073006300650063006c00690000000000	c7d591d67eaef372ed375a0aaf2a0c76_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\2d.ocx	c7d591d67eaef372ed375a0aaf2a0c76_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\2d.ocx	c7d591d67eaef372ed375a0aaf2a0c76_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c7d591d67eaef372ed375a0aaf2a0c76_JaffaCakes118.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	c7d591d67eaef372ed375a0aaf2a0c76_JaffaCakes118.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController	c7d591d67eaef372ed375a0aaf2a0c76_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\HARDWARE\Description\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	c7d591d67eaef372ed375a0aaf2a0c76_JaffaCakes118.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	c7d591d67eaef372ed375a0aaf2a0c76_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\HARDWARE\Description\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0	c7d591d67eaef372ed375a0aaf2a0c76_JaffaCakes118.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0	c7d591d67eaef372ed375a0aaf2a0c76_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0\Identifier	c7d591d67eaef372ed375a0aaf2a0c76_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\HARDWARE\Description\System\MultifunctionAdapter	c7d591d67eaef372ed375a0aaf2a0c76_JaffaCakes118.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	c7d591d67eaef372ed375a0aaf2a0c76_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\HARDWARE\Description\System\MultifunctionAdapter\0	c7d591d67eaef372ed375a0aaf2a0c76_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\HARDWARE\Description\System\MultifunctionAdapter\0\DiskController	c7d591d67eaef372ed375a0aaf2a0c76_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\HARDWARE\Description\System\MultifunctionAdapter\0\DiskController\0	c7d591d67eaef372ed375a0aaf2a0c76_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1916	c7d591d67eaef372ed375a0aaf2a0c76_JaffaCakes118.exe
1916	c7d591d67eaef372ed375a0aaf2a0c76_JaffaCakes118.exe
1916	c7d591d67eaef372ed375a0aaf2a0c76_JaffaCakes118.exe
1916	c7d591d67eaef372ed375a0aaf2a0c76_JaffaCakes118.exe
1916	c7d591d67eaef372ed375a0aaf2a0c76_JaffaCakes118.exe
1916	c7d591d67eaef372ed375a0aaf2a0c76_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 2968	1916	c7d591d67eaef372ed375a0aaf2a0c76_JaffaCakes118.exe	50
PID 1916 wrote to memory of 2968	1916	c7d591d67eaef372ed375a0aaf2a0c76_JaffaCakes118.exe	50
PID 1916 wrote to memory of 3052	1916	c7d591d67eaef372ed375a0aaf2a0c76_JaffaCakes118.exe	52
PID 1916 wrote to memory of 3052	1916	c7d591d67eaef372ed375a0aaf2a0c76_JaffaCakes118.exe	52
PID 1916 wrote to memory of 3096	1916	c7d591d67eaef372ed375a0aaf2a0c76_JaffaCakes118.exe	53
PID 1916 wrote to memory of 3096	1916	c7d591d67eaef372ed375a0aaf2a0c76_JaffaCakes118.exe	53
PID 1916 wrote to memory of 3596	1916	c7d591d67eaef372ed375a0aaf2a0c76_JaffaCakes118.exe	56
PID 1916 wrote to memory of 3596	1916	c7d591d67eaef372ed375a0aaf2a0c76_JaffaCakes118.exe	56
PID 1916 wrote to memory of 3724	1916	c7d591d67eaef372ed375a0aaf2a0c76_JaffaCakes118.exe	57
PID 1916 wrote to memory of 3724	1916	c7d591d67eaef372ed375a0aaf2a0c76_JaffaCakes118.exe	57
PID 1916 wrote to memory of 3920	1916	c7d591d67eaef372ed375a0aaf2a0c76_JaffaCakes118.exe	58
PID 1916 wrote to memory of 3920	1916	c7d591d67eaef372ed375a0aaf2a0c76_JaffaCakes118.exe	58
PID 1916 wrote to memory of 4008	1916	c7d591d67eaef372ed375a0aaf2a0c76_JaffaCakes118.exe	59
PID 1916 wrote to memory of 4008	1916	c7d591d67eaef372ed375a0aaf2a0c76_JaffaCakes118.exe	59
PID 1916 wrote to memory of 4080	1916	c7d591d67eaef372ed375a0aaf2a0c76_JaffaCakes118.exe	60
PID 1916 wrote to memory of 4080	1916	c7d591d67eaef372ed375a0aaf2a0c76_JaffaCakes118.exe	60
PID 1916 wrote to memory of 2648	1916	c7d591d67eaef372ed375a0aaf2a0c76_JaffaCakes118.exe	61
PID 1916 wrote to memory of 2648	1916	c7d591d67eaef372ed375a0aaf2a0c76_JaffaCakes118.exe	61
PID 1916 wrote to memory of 4240	1916	c7d591d67eaef372ed375a0aaf2a0c76_JaffaCakes118.exe	62
PID 1916 wrote to memory of 4240	1916	c7d591d67eaef372ed375a0aaf2a0c76_JaffaCakes118.exe	62
PID 1916 wrote to memory of 4728	1916	c7d591d67eaef372ed375a0aaf2a0c76_JaffaCakes118.exe	64
PID 1916 wrote to memory of 4728	1916	c7d591d67eaef372ed375a0aaf2a0c76_JaffaCakes118.exe	64
PID 1916 wrote to memory of 4136	1916	c7d591d67eaef372ed375a0aaf2a0c76_JaffaCakes118.exe	75
PID 1916 wrote to memory of 4136	1916	c7d591d67eaef372ed375a0aaf2a0c76_JaffaCakes118.exe	75
PID 1916 wrote to memory of 4148	1916	c7d591d67eaef372ed375a0aaf2a0c76_JaffaCakes118.exe	78
PID 1916 wrote to memory of 4148	1916	c7d591d67eaef372ed375a0aaf2a0c76_JaffaCakes118.exe	78
PID 1916 wrote to memory of 3368	1916	c7d591d67eaef372ed375a0aaf2a0c76_JaffaCakes118.exe	79
PID 1916 wrote to memory of 3368	1916	c7d591d67eaef372ed375a0aaf2a0c76_JaffaCakes118.exe	79
PID 1916 wrote to memory of 4168	1916	c7d591d67eaef372ed375a0aaf2a0c76_JaffaCakes118.exe	80
PID 1916 wrote to memory of 4168	1916	c7d591d67eaef372ed375a0aaf2a0c76_JaffaCakes118.exe	80
PID 1916 wrote to memory of 728	1916	c7d591d67eaef372ed375a0aaf2a0c76_JaffaCakes118.exe	81
PID 1916 wrote to memory of 728	1916	c7d591d67eaef372ed375a0aaf2a0c76_JaffaCakes118.exe	81
PID 1916 wrote to memory of 4676	1916	c7d591d67eaef372ed375a0aaf2a0c76_JaffaCakes118.exe	82
PID 1916 wrote to memory of 4676	1916	c7d591d67eaef372ed375a0aaf2a0c76_JaffaCakes118.exe	82
PID 1916 wrote to memory of 3804	1916	c7d591d67eaef372ed375a0aaf2a0c76_JaffaCakes118.exe	88
PID 1916 wrote to memory of 3804	1916	c7d591d67eaef372ed375a0aaf2a0c76_JaffaCakes118.exe	88
PID 1916 wrote to memory of 2184	1916	c7d591d67eaef372ed375a0aaf2a0c76_JaffaCakes118.exe	92
PID 1916 wrote to memory of 2184	1916	c7d591d67eaef372ed375a0aaf2a0c76_JaffaCakes118.exe	92
PID 1916 wrote to memory of 4180	1916	c7d591d67eaef372ed375a0aaf2a0c76_JaffaCakes118.exe	93
PID 1916 wrote to memory of 4180	1916	c7d591d67eaef372ed375a0aaf2a0c76_JaffaCakes118.exe	93
PID 1916 wrote to memory of 3456	1916	c7d591d67eaef372ed375a0aaf2a0c76_JaffaCakes118.exe	100
PID 1916 wrote to memory of 3456	1916	c7d591d67eaef372ed375a0aaf2a0c76_JaffaCakes118.exe	100
PID 1916 wrote to memory of 4444	1916	c7d591d67eaef372ed375a0aaf2a0c76_JaffaCakes118.exe	117
PID 1916 wrote to memory of 4444	1916	c7d591d67eaef372ed375a0aaf2a0c76_JaffaCakes118.exe	117

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3052

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:3096

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3596
- C:\Users\Admin\AppData\Local\Temp\c7d591d67eaef372ed375a0aaf2a0c76_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7d591d67eaef372ed375a0aaf2a0c76_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Boot or Logon Autostart Execution: Authentication Package
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1916

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3724

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3920

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4008

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4080

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:2648

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4240

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4728

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:4136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
1⤵
PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=127.0.6533.89 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=127.0.2651.86 --initial-client-data=0x23c,0x240,0x244,0x238,0x1a0,0x7ffa1f0bd198,0x7ffa1f0bd1a4,0x7ffa1f0bd1b0
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2312,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:2
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --field-trial-handle=1964,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:3
  2⤵
  PID:728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --field-trial-handle=2468,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:8
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4336,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=1040 /prefetch:8
  2⤵
  PID:3456

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
1⤵
PID:3804

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2184

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4180

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\s5ADD.tmp

Filesize
72KB

MD5
007f14c48a9898acc4331d3479f74ad3

SHA1
d13f6f259e0e723d7e442b82597d732de47f0191

SHA256
6e090a77f1c29aecdcd49657efb8db9084d5a879a5b6f851f6f949ed2908d1c1

SHA512
4045cb89723c1faf3d0a273cadf7327953cef16406abb27b47c6ef06e995ea4f3f9d8458cc6ac2499d9cbfeb9142b64c1e8631954f8884c2586fe88eaa241002

Download Submit
memory/1916-0-0x00000000001D0000-0x00000000001E2000-memory.dmp

Filesize
72KB

Download
memory/1916-5-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download