b7c55231a70ea6eb07a17fa7f2174ae10290e309720da00347f7b236a75c026b

Analysis

max time kernel
14s
max time network
15s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15/09/2024, 00:35

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

e15a90d6dff8823c07b892d7ae857066_JaffaCakes118.exe
Size

124KB
MD5

e15a90d6dff8823c07b892d7ae857066
SHA1

de3be935604745340eefea5e2e048a298f5cc1c4
SHA256

b7c55231a70ea6eb07a17fa7f2174ae10290e309720da00347f7b236a75c026b
SHA512

ae75003b1fd6cc2086df77c7d00fc2a568feb847a83c0aa296a5cc32c5af0fafe5d4d920815f398eef05e2cf4f3d7e9fe262b53b7256cfe125074e65176744ad
SSDEEP

3072:iTTSzzvFjj4WAStvQmnbeQA4XBiG4dsoVwuaFagBoN2z4RDO9Kb:3ZcvMv3IG4dsoVwuKaYX6Dp

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\windows\Dube.sys	e15a90d6dff8823c07b892d7ae857066_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e15a90d6dff8823c07b892d7ae857066_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shutdown.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2716	shutdown.exe
Token: SeRemoteShutdownPrivilege	2716	shutdown.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 2716	1620	e15a90d6dff8823c07b892d7ae857066_JaffaCakes118.exe	32
PID 1620 wrote to memory of 2716	1620	e15a90d6dff8823c07b892d7ae857066_JaffaCakes118.exe	32
PID 1620 wrote to memory of 2716	1620	e15a90d6dff8823c07b892d7ae857066_JaffaCakes118.exe	32
PID 1620 wrote to memory of 2716	1620	e15a90d6dff8823c07b892d7ae857066_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\e15a90d6dff8823c07b892d7ae857066_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e15a90d6dff8823c07b892d7ae857066_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Windows\SysWOW64\shutdown.exe
  "C:\Windows\System32\shutdown.exe" -r -f -t 00
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2716

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:968

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:1444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PLSLTMYI\ES3MJPGS.htm

Filesize
87KB

MD5
32a4cd602d0b8308c59199b09f97eb42

SHA1
563eeb68f679663f50e548f6b3fe159fe64cd6c2

SHA256
ae065ea2bdecfef71e6244ebdb1521c9cc83e11113fa71dcf5e3d85f939dd693

SHA512
6c3c8cfa904228a5912b437394ccf7e4547957b1ccccb983bb48a9a5f9d96aa6657cc66739588d5d392b8bc0b337f45239f45367278becc212e63bbe040f1720

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PLSLTMYI\command[1].htm

Filesize
167B

MD5
0104c301c5e02bd6148b8703d19b3a73

SHA1
7436e0b4b1f8c222c38069890b75fa2baf9ca620

SHA256
446a6087825fa73eadb045e5a2e9e2adf7df241b571228187728191d961dda1f

SHA512
84427b656a6234a651a6d8285c103645b861a18a6c5af4abb5cb4f3beb5a4f0df4a74603a0896c7608790fbb886dc40508e92d5709f44dca05dd46c8316d15bf

Download Submit
memory/968-49-0x0000000002D90000-0x0000000002D91000-memory.dmp

Filesize
4KB

Download
memory/1444-50-0x0000000002AB0000-0x0000000002AB1000-memory.dmp

Filesize
4KB

Download
memory/1620-21-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1620-48-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download