c2e08878b9e2df906c2032b5609cb40b01e14fc6a4e8973cab0553d71dcaf1fb

Analysis

max time kernel
94s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18/09/2024, 21:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e9f7be53f96c90fecbf83c04a1814ea7_JaffaCakes118.exe
Size

88KB
MD5

e9f7be53f96c90fecbf83c04a1814ea7
SHA1

50539cf4998804a27acfda224d8e6c6273ff06f5
SHA256

c2e08878b9e2df906c2032b5609cb40b01e14fc6a4e8973cab0553d71dcaf1fb
SHA512

b4127dda0719e609550946a77b15e9223f222c81995215b0581acec6dbf086984644af25288b3d84d432da0d734764ea353d7b5cdf643d2985b73349edf53a09
SSDEEP

1536:ObwRc4N1gQOwm4B4PJh6VB9o9lcY/3t2eVgxWz5FsuWBVlTik9bu382iF60+:gwR5g46PJh+jgSO5gxWzzsuumIuM2E+

Score

8^/10

discovery evasion

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\WINDOWS\system32\drivers\etc\hosts	cmd.exe
File opened for modification	C:\Windows\SYSTEM32\drivers\etc\hosts	cmd.exe

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
3520	attrib.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	e9f7be53f96c90fecbf83c04a1814ea7_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

pid	Process
892	dnfº£Ñý0610×îÐÂÎÈ¶¨°æ.exe
3288	hosts.exe

Loads dropped DLL 1 IoCs

pid	Process
2244	e9f7be53f96c90fecbf83c04a1814ea7_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e9f7be53f96c90fecbf83c04a1814ea7_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dnfº£Ñý0610×îÐÂÎÈ¶¨°æ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2912	PING.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	e9f7be53f96c90fecbf83c04a1814ea7_JaffaCakes118.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2912	PING.EXE

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
892	dnfº£Ñý0610×îÐÂÎÈ¶¨°æ.exe
892	dnfº£Ñý0610×îÐÂÎÈ¶¨°æ.exe
892	dnfº£Ñý0610×îÐÂÎÈ¶¨°æ.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 892	2244	e9f7be53f96c90fecbf83c04a1814ea7_JaffaCakes118.exe	82
PID 2244 wrote to memory of 892	2244	e9f7be53f96c90fecbf83c04a1814ea7_JaffaCakes118.exe	82
PID 2244 wrote to memory of 892	2244	e9f7be53f96c90fecbf83c04a1814ea7_JaffaCakes118.exe	82
PID 2244 wrote to memory of 3288	2244	e9f7be53f96c90fecbf83c04a1814ea7_JaffaCakes118.exe	83
PID 2244 wrote to memory of 3288	2244	e9f7be53f96c90fecbf83c04a1814ea7_JaffaCakes118.exe	83
PID 2244 wrote to memory of 3288	2244	e9f7be53f96c90fecbf83c04a1814ea7_JaffaCakes118.exe	83
PID 3288 wrote to memory of 4704	3288	hosts.exe	84
PID 3288 wrote to memory of 4704	3288	hosts.exe	84
PID 3288 wrote to memory of 4704	3288	hosts.exe	84
PID 4704 wrote to memory of 3136	4704	cmd.exe	86
PID 4704 wrote to memory of 3136	4704	cmd.exe	86
PID 4704 wrote to memory of 3136	4704	cmd.exe	86
PID 4704 wrote to memory of 3028	4704	cmd.exe	87
PID 4704 wrote to memory of 3028	4704	cmd.exe	87
PID 4704 wrote to memory of 3028	4704	cmd.exe	87
PID 4704 wrote to memory of 4976	4704	cmd.exe	88
PID 4704 wrote to memory of 4976	4704	cmd.exe	88
PID 4704 wrote to memory of 4976	4704	cmd.exe	88
PID 4704 wrote to memory of 2912	4704	cmd.exe	89
PID 4704 wrote to memory of 2912	4704	cmd.exe	89
PID 4704 wrote to memory of 2912	4704	cmd.exe	89
PID 4704 wrote to memory of 4324	4704	cmd.exe	90
PID 4704 wrote to memory of 4324	4704	cmd.exe	90
PID 4704 wrote to memory of 4324	4704	cmd.exe	90
PID 4704 wrote to memory of 116	4704	cmd.exe	91
PID 4704 wrote to memory of 116	4704	cmd.exe	91
PID 4704 wrote to memory of 116	4704	cmd.exe	91
PID 4704 wrote to memory of 4044	4704	cmd.exe	92
PID 4704 wrote to memory of 4044	4704	cmd.exe	92
PID 4704 wrote to memory of 4044	4704	cmd.exe	92
PID 4704 wrote to memory of 3520	4704	cmd.exe	93
PID 4704 wrote to memory of 3520	4704	cmd.exe	93
PID 4704 wrote to memory of 3520	4704	cmd.exe	93

Views/modifies file attributes 1 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
4976	attrib.exe
4044	attrib.exe
3520	attrib.exe

C:\Users\Admin\AppData\Local\Temp\e9f7be53f96c90fecbf83c04a1814ea7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e9f7be53f96c90fecbf83c04a1814ea7_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Users\Admin\AppData\Local\Temp\dnfº£Ñý0610×îÐÂÎÈ¶¨°æ.exe
  "C:\Users\Admin\AppData\Local\Temp\dnfº£Ñý0610×îÐÂÎÈ¶¨°æ.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:892
- C:\Users\Admin\AppData\Local\Temp\hosts.exe
  "C:\Users\Admin\AppData\Local\Temp\hosts.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3288
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~ADD4.bat "C:\Users\Admin\AppData\Local\Temp\hosts.exe"
    3⤵
    - Drops file in Drivers directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4704
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo y"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3136
  - - C:\Windows\SysWOW64\cacls.exe
      cacls C:\Windows\system32\drivers\etc\hosts /g everyone:f
      4⤵
      System Location Discovery: System Language Discovery
      PID:3028
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -r -a -s -h C:\Windows\system32\drivers\etc\hosts
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:4976
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 3 127.1
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2912
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo y"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4324
  - - C:\Windows\SysWOW64\cacls.exe
      cacls C:\Windows\system32\drivers\etc\hosts /g everyone:f
      4⤵
      System Location Discovery: System Language Discovery
      PID:116
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -r -a -s -h C:\Windows\system32\drivers\etc\hosts
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:4044
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +r +a +s +h C:\Windows\system32\drivers\etc\hosts
      4⤵
      Sets file to hidden
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:3520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\dnfº£Ñý0610×îÐÂÎÈ¶¨°æ.exe

Filesize
56KB

MD5
28ce3dfb446d2fca4a8a803f94ab7429

SHA1
e7bc21e198458a20ac7bc270a0228e468c21238a

SHA256
651f6ab1bbba3b204224459b13653c5dd3db6fba7fae6b6e988ad97f36928ad5

SHA512
a318148e11790532e8c75df2839494873b39e3d4d5db462eb0a3d3c05cfb20bc7da14fdae098875fb679e8c87855581184099fa37cb52a4e707beb9d843f17dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\hosts.exe

Filesize
60KB

MD5
fe89f41edbcd1c0ef19d8eed1dbd52c2

SHA1
b499f049be280011e2541a0dee8703d0f164673c

SHA256
0fc98a742bdceb92f9999b6ae0fa55133519638d44d227bc49a1446da80dd148

SHA512
19c27a66c5b6168cea9251b867fc3a67d5f56d1df29b190c955d61410c53b6b3c480331eba8f11daba9e8c838291c7bb73ddc5a0b46862832f80403554fc8a0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjAAF6.tmp\System.dll

Filesize
10KB

MD5
0c8ea8e6637bbf8408104e672d78ba45

SHA1
c231c7acaf9abb7da93f28e1b71bed164d57103e

SHA256
509a93177a7ae130bc3b6b5ec3236c7aa0811b8b86f8ab3442c65fdf8ff85b1f

SHA512
ee763a3cdbbba3b28e6a903ac942c7228bd8e54b19de21d6187e481f2916d833d9b9800e5ac2998f4aa26274cdfb20a8bfdd10f00f2a15d37bcc529b617e1f28

Download Submit
C:\Users\Admin\AppData\Local\Temp\~ADD4.bat

Filesize
12KB

MD5
4fda9a3535997f3b33c2cf4d9c7b6909

SHA1
5410e35ed23431b27222200b80f662a9d07d5c10

SHA256
edb385700a67b2f5d724f6323b91589cf061b01f4b7af2cd1966b3208f0346cd

SHA512
5b26f7f6c488cb3fe7ce2199b43ef830734c2ce1923ce8cfe2d529088585826a4efef8a02413544e87fb01cfc5dbaaa9e5ba347f3260057745380fa20756b212

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
4KB

MD5
bc8d524e22cd3ea451f779358b9e6b98

SHA1
33f63c1c9e1b408d3a335c579ed2b64e4dcf596a

SHA256
82f2712976c407f09f356f1c1b93f95982945615a1c022b1b0fc4212086f6fc5

SHA512
0198a9f2593a78ca3e7201b6d1c5033d62cc21d4897ec804df94dd002a77d31d8e882902e2aa390248cc0180b2b790b9afeb6e9f618d0033537d7a35601def81

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
24B

MD5
893da8918c2ffb3792509fd7a9e38d82

SHA1
7a0fa30babed453d62cf5bb31ab9da01407f4ac2

SHA256
ae84e50c4049a78e8300a60721ae92ef67ab35259648ec41747e7e1858ba5522

SHA512
7718b2b459978a8a4a0a4b1a1bf219efea29c3e795304b324b32bb5b618e03aa8bd159d54bd867dedc6e0cfe243f0466bfd46c8daf6beed6333cc113d8ab5198

Download Submit
memory/3288-286-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads