6f0ef8e1233eb468bcfe072e2a5b9e87c24ae90bdfbe9f628bab148474178823

Analysis

max time kernel
138s
max time network
139s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 06:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eac59aa13a85943921230368aa9b5ed6_JaffaCakes118.exe
Size

148KB
MD5

eac59aa13a85943921230368aa9b5ed6
SHA1

cc48d6938526e4d594d1bbb64e995c206cd63f05
SHA256

6f0ef8e1233eb468bcfe072e2a5b9e87c24ae90bdfbe9f628bab148474178823
SHA512

4a36d823f46edb65f6856e18feeac84b0011ff5288da464241139d6928d14c386f4e606175b88723c8e25ce20e1bc48691bc0a8078539bcaacda5d4645a1f1ca
SSDEEP

3072:05EHENWuAglqQcngq5KGfDJCUrdrVPjTSgUjrZ9Wxb9k40WPL:GKEVlqb/nbJCUrD72gUvkJ

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2140	explorer.exe

Executes dropped EXE 1 IoCs

pid	Process
336	csrss.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	\systemroot\assembly\GAC_64\Desktop.ini	csrss.exe
File created	\systemroot\assembly\GAC_32\Desktop.ini	csrss.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2580 set thread context of 2140	2580	eac59aa13a85943921230368aa9b5ed6_JaffaCakes118.exe	30

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eac59aa13a85943921230368aa9b5ed6_JaffaCakes118.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\registry\machine\Software\Classes\Interface\{e6a31145-02ba-e2be-a259-2e89fe48c80c}	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{e6a31145-02ba-e2be-a259-2e89fe48c80c}\u = "860049491"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{e6a31145-02ba-e2be-a259-2e89fe48c80c}\cid = "2989688509549216543"	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2140	explorer.exe
2140	explorer.exe
2140	explorer.exe
336	csrss.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2140	explorer.exe
Token: SeAssignPrimaryTokenPrivilege	868	svchost.exe
Token: SeIncreaseQuotaPrivilege	868	svchost.exe
Token: SeSecurityPrivilege	868	svchost.exe
Token: SeTakeOwnershipPrivilege	868	svchost.exe
Token: SeLoadDriverPrivilege	868	svchost.exe
Token: SeRestorePrivilege	868	svchost.exe
Token: SeSystemEnvironmentPrivilege	868	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	868	svchost.exe
Token: SeIncreaseQuotaPrivilege	868	svchost.exe
Token: SeSecurityPrivilege	868	svchost.exe
Token: SeTakeOwnershipPrivilege	868	svchost.exe
Token: SeLoadDriverPrivilege	868	svchost.exe
Token: SeSystemtimePrivilege	868	svchost.exe
Token: SeBackupPrivilege	868	svchost.exe
Token: SeRestorePrivilege	868	svchost.exe
Token: SeShutdownPrivilege	868	svchost.exe
Token: SeSystemEnvironmentPrivilege	868	svchost.exe
Token: SeUndockPrivilege	868	svchost.exe
Token: SeManageVolumePrivilege	868	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	868	svchost.exe
Token: SeIncreaseQuotaPrivilege	868	svchost.exe
Token: SeSecurityPrivilege	868	svchost.exe
Token: SeTakeOwnershipPrivilege	868	svchost.exe
Token: SeLoadDriverPrivilege	868	svchost.exe
Token: SeRestorePrivilege	868	svchost.exe
Token: SeSystemEnvironmentPrivilege	868	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	868	svchost.exe
Token: SeIncreaseQuotaPrivilege	868	svchost.exe
Token: SeSecurityPrivilege	868	svchost.exe
Token: SeTakeOwnershipPrivilege	868	svchost.exe
Token: SeLoadDriverPrivilege	868	svchost.exe
Token: SeRestorePrivilege	868	svchost.exe
Token: SeSystemEnvironmentPrivilege	868	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	868	svchost.exe
Token: SeIncreaseQuotaPrivilege	868	svchost.exe
Token: SeSecurityPrivilege	868	svchost.exe
Token: SeTakeOwnershipPrivilege	868	svchost.exe
Token: SeLoadDriverPrivilege	868	svchost.exe
Token: SeSystemtimePrivilege	868	svchost.exe
Token: SeBackupPrivilege	868	svchost.exe
Token: SeRestorePrivilege	868	svchost.exe
Token: SeShutdownPrivilege	868	svchost.exe
Token: SeSystemEnvironmentPrivilege	868	svchost.exe
Token: SeUndockPrivilege	868	svchost.exe
Token: SeManageVolumePrivilege	868	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	868	svchost.exe
Token: SeIncreaseQuotaPrivilege	868	svchost.exe
Token: SeSecurityPrivilege	868	svchost.exe
Token: SeTakeOwnershipPrivilege	868	svchost.exe
Token: SeLoadDriverPrivilege	868	svchost.exe
Token: SeSystemtimePrivilege	868	svchost.exe
Token: SeBackupPrivilege	868	svchost.exe
Token: SeRestorePrivilege	868	svchost.exe
Token: SeShutdownPrivilege	868	svchost.exe
Token: SeSystemEnvironmentPrivilege	868	svchost.exe
Token: SeUndockPrivilege	868	svchost.exe
Token: SeManageVolumePrivilege	868	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	868	svchost.exe
Token: SeIncreaseQuotaPrivilege	868	svchost.exe
Token: SeSecurityPrivilege	868	svchost.exe
Token: SeTakeOwnershipPrivilege	868	svchost.exe
Token: SeLoadDriverPrivilege	868	svchost.exe
Token: SeSystemtimePrivilege	868	svchost.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
336	csrss.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 2140	2580	eac59aa13a85943921230368aa9b5ed6_JaffaCakes118.exe	30
PID 2580 wrote to memory of 2140	2580	eac59aa13a85943921230368aa9b5ed6_JaffaCakes118.exe	30
PID 2580 wrote to memory of 2140	2580	eac59aa13a85943921230368aa9b5ed6_JaffaCakes118.exe	30
PID 2580 wrote to memory of 2140	2580	eac59aa13a85943921230368aa9b5ed6_JaffaCakes118.exe	30
PID 2580 wrote to memory of 2140	2580	eac59aa13a85943921230368aa9b5ed6_JaffaCakes118.exe	30
PID 2140 wrote to memory of 336	2140	explorer.exe	2
PID 336 wrote to memory of 2776	336	csrss.exe	31
PID 336 wrote to memory of 2776	336	csrss.exe	31
PID 336 wrote to memory of 868	336	csrss.exe	13

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:336

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:868
- C:\Windows\system32\wbem\WMIADAP.EXE
  wmiadap.exe /F /T /R
  2⤵
  PID:2776

C:\Users\Admin\AppData\Local\Temp\eac59aa13a85943921230368aa9b5ed6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eac59aa13a85943921230368aa9b5ed6_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Windows\explorer.exe
  00000098*
  2⤵
  - Deletes itself
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system32\consrv.DLL

Filesize
52KB

MD5
c7570a7e24b29ee04a48c2c99da2587b

SHA1
b6e3635a8de44b1635e8d362ac131e14281feb24

SHA256
717cd7661c09701ee39c505d8b604ea3dd6c1151ef18e7ed1cab3832552ac34b

SHA512
57479d2f5386ace8cc5e5ed543e6ad2c2b7b58accc849807d804a8cf0d03080f328f7b42442422fa1483a01ad473ca302f9eca97b9eb24e699e22db56641c572

Download Submit
\??\globalroot\systemroot\assembly\temp\@

Filesize
2KB

MD5
853150deb50b4f8a55b57e232cb93d76

SHA1
2d83c0b9d334e72a30cea831eeb94d41d1668f33

SHA256
64dde879567884b697cc894c2c7394af23804b0bcd65ac132c6a9c5fb2f4b622

SHA512
ac2e1867651ab7d962841ab81527933274c9c72d3b516e8d38cdf99bcbd5d7d1792b7e8b0c4c1932734dcfa1c682bf8978dea393d2428a146fab96d4cc9a4be4

Download Submit
memory/336-28-0x0000000000E20000-0x0000000000E32000-memory.dmp

Filesize
72KB

Download
memory/336-27-0x0000000000E20000-0x0000000000E32000-memory.dmp

Filesize
72KB

Download
memory/336-24-0x0000000000E20000-0x0000000000E32000-memory.dmp

Filesize
72KB

Download
memory/336-23-0x0000000000E20000-0x0000000000E32000-memory.dmp

Filesize
72KB

Download
memory/868-31-0x0000000000CD0000-0x0000000000CDB000-memory.dmp

Filesize
44KB

Download
memory/868-35-0x0000000000CD0000-0x0000000000CDB000-memory.dmp

Filesize
44KB

Download
memory/868-48-0x0000000000CE0000-0x0000000000CEB000-memory.dmp

Filesize
44KB

Download
memory/868-39-0x0000000000CD0000-0x0000000000CDB000-memory.dmp

Filesize
44KB

Download
memory/868-40-0x0000000000CE0000-0x0000000000CEB000-memory.dmp

Filesize
44KB

Download
memory/868-30-0x0000000000CC0000-0x0000000000CC8000-memory.dmp

Filesize
32KB

Download
memory/2140-5-0x0000000000060000-0x0000000000075000-memory.dmp

Filesize
84KB

Download
memory/2140-17-0x0000000000180000-0x0000000000199000-memory.dmp

Filesize
100KB

Download
memory/2140-13-0x0000000000180000-0x0000000000199000-memory.dmp

Filesize
100KB

Download
memory/2140-7-0x0000000000180000-0x0000000000199000-memory.dmp

Filesize
100KB

Download
memory/2580-2-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2580-3-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2580-0-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2580-4-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2580-1-0x0000000000402000-0x0000000000403000-memory.dmp

Filesize
4KB

Download