029fd89580879f7bd871d8b6e9ca3346f30822eb47fde56e422c46c7cfa9848e

Analysis

max time kernel
150s
max time network
147s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/09/2024, 23:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e13fbe2c63e0d1147d6f7657f636af02_JaffaCakes118.exe
Size

141KB
MD5

e13fbe2c63e0d1147d6f7657f636af02
SHA1

ea00c973b8583861e858d0bd13458feaff2c1224
SHA256

029fd89580879f7bd871d8b6e9ca3346f30822eb47fde56e422c46c7cfa9848e
SHA512

5578d68242fa5079e87bb6951d6523953ca1ade4578f4d6aef1ade05c2a1676c832579047a2c1ea7cc6b0a0a1a61991dc5bf48b362e388f1d3f4f00cb915d51e
SSDEEP

3072:0WRji7yss5/SA4WqoB8n1LjylDqyij2c8NQeHp+3wzpUv/Gmsr:0OJssVd4f1ylLAXeJZ9Uv/G/r

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2844	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2828	oluw.exe

Loads dropped DLL 2 IoCs

pid	Process
2228	e13fbe2c63e0d1147d6f7657f636af02_JaffaCakes118.exe
2228	e13fbe2c63e0d1147d6f7657f636af02_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\{52892F59-513E-4132-36E7-020648FA0BEC} = "C:\\Users\\Admin\\AppData\\Roaming\\Ygwoqi\\oluw.exe"	oluw.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e13fbe2c63e0d1147d6f7657f636af02_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oluw.exe

Suspicious behavior: EnumeratesProcesses 58 IoCs

pid	Process
2828	oluw.exe
2828	oluw.exe
2828	oluw.exe
2828	oluw.exe
2828	oluw.exe
2828	oluw.exe
2828	oluw.exe
2828	oluw.exe
2828	oluw.exe
2828	oluw.exe
2828	oluw.exe
2828	oluw.exe
2828	oluw.exe
2828	oluw.exe
2828	oluw.exe
2828	oluw.exe
2828	oluw.exe
2828	oluw.exe
2828	oluw.exe
2828	oluw.exe
2828	oluw.exe
2828	oluw.exe
2828	oluw.exe
2828	oluw.exe
2828	oluw.exe
2828	oluw.exe
2828	oluw.exe
2828	oluw.exe
2828	oluw.exe
2828	oluw.exe
2828	oluw.exe
2828	oluw.exe
2828	oluw.exe
2828	oluw.exe
2828	oluw.exe
2828	oluw.exe
2828	oluw.exe
2828	oluw.exe
2828	oluw.exe
2828	oluw.exe
2828	oluw.exe
2828	oluw.exe
2828	oluw.exe
2828	oluw.exe
2828	oluw.exe
2828	oluw.exe
2828	oluw.exe
2828	oluw.exe
2828	oluw.exe
2828	oluw.exe
2828	oluw.exe
2828	oluw.exe
2828	oluw.exe
2828	oluw.exe
2828	oluw.exe
2828	oluw.exe
2828	oluw.exe
2828	oluw.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeSecurityPrivilege	2228	e13fbe2c63e0d1147d6f7657f636af02_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 2828	2228	e13fbe2c63e0d1147d6f7657f636af02_JaffaCakes118.exe	30
PID 2228 wrote to memory of 2828	2228	e13fbe2c63e0d1147d6f7657f636af02_JaffaCakes118.exe	30
PID 2228 wrote to memory of 2828	2228	e13fbe2c63e0d1147d6f7657f636af02_JaffaCakes118.exe	30
PID 2228 wrote to memory of 2828	2228	e13fbe2c63e0d1147d6f7657f636af02_JaffaCakes118.exe	30
PID 2828 wrote to memory of 2596	2828	oluw.exe	31
PID 2828 wrote to memory of 2596	2828	oluw.exe	31
PID 2828 wrote to memory of 2596	2828	oluw.exe	31
PID 2828 wrote to memory of 2596	2828	oluw.exe	31
PID 2828 wrote to memory of 2596	2828	oluw.exe	31
PID 2828 wrote to memory of 2596	2828	oluw.exe	31
PID 2828 wrote to memory of 2596	2828	oluw.exe	31
PID 2828 wrote to memory of 2596	2828	oluw.exe	31
PID 2828 wrote to memory of 2596	2828	oluw.exe	31
PID 2828 wrote to memory of 2596	2828	oluw.exe	31
PID 2228 wrote to memory of 2844	2228	e13fbe2c63e0d1147d6f7657f636af02_JaffaCakes118.exe	32
PID 2228 wrote to memory of 2844	2228	e13fbe2c63e0d1147d6f7657f636af02_JaffaCakes118.exe	32
PID 2228 wrote to memory of 2844	2228	e13fbe2c63e0d1147d6f7657f636af02_JaffaCakes118.exe	32
PID 2228 wrote to memory of 2844	2228	e13fbe2c63e0d1147d6f7657f636af02_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\e13fbe2c63e0d1147d6f7657f636af02_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e13fbe2c63e0d1147d6f7657f636af02_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Users\Admin\AppData\Roaming\Ygwoqi\oluw.exe
  "C:\Users\Admin\AppData\Roaming\Ygwoqi\oluw.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2828
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    3⤵
    PID:2596
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpac641c62.bat"
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpac641c62.bat

Filesize
271B

MD5
ed30ba629a8a695bdc9f27192ed60317

SHA1
3e42f3aeba4819edf74abc626ba595f8c97201de

SHA256
092317d3cc8628ceb24b323923236cf77b63c21c8467e8a8fcfb1e5de0557c6c

SHA512
f3b6cdecf82710f06a1bd5dd364e63525ed939f867a5e525c8337d5a0dffd22e6f493cacb3ff5fe4d8b90f34e74c120f0f8e96fa979a6d5dfd83b01954e926b7

Download Submit
\Users\Admin\AppData\Roaming\Ygwoqi\oluw.exe

Filesize
141KB

MD5
3a8f97d9eab34f27008f9cc0afcb6b76

SHA1
a43ad796a5cace2511eb324417576f0d20de3c59

SHA256
97f3fe1fd5f7b059ab9634f6abfda6704b60ebf1b7c7daa7837376afc17786e3

SHA512
e52e917723b4dc6b87d60dea057437a5b163dda5632471b46d3a3ac3c97b0c0e42932ef4a21ae529ffe69d3359499e53440e09b226a6107aac9dd70832e4f766

Download Submit
memory/2228-25-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2228-3-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2228-4-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2228-1-0x0000000000403000-0x0000000000407000-memory.dmp

Filesize
16KB

Download
memory/2228-9-0x00000000004F0000-0x0000000000530000-memory.dmp

Filesize
256KB

Download
memory/2228-2-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2228-26-0x0000000000403000-0x0000000000407000-memory.dmp

Filesize
16KB

Download
memory/2228-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2596-21-0x00000000000E0000-0x0000000000102000-memory.dmp

Filesize
136KB

Download
memory/2596-22-0x00000000000E0000-0x0000000000102000-memory.dmp

Filesize
136KB

Download
memory/2596-20-0x00000000000E0000-0x0000000000102000-memory.dmp

Filesize
136KB

Download
memory/2596-19-0x00000000000E0000-0x0000000000102000-memory.dmp

Filesize
136KB

Download
memory/2596-18-0x00000000000E0000-0x0000000000102000-memory.dmp

Filesize
136KB

Download
memory/2596-23-0x00000000000E0000-0x0000000000102000-memory.dmp

Filesize
136KB

Download
memory/2828-16-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2828-15-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2828-28-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2828-34-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download