0bc632379f3e05ae529a1c1e72e4b1e878bc95ac8ff67785c57396713c7973e9

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 16:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ebb42addcac9fd0f483278f6e9076d98_JaffaCakes118.exe
Size

1.2MB
MD5

ebb42addcac9fd0f483278f6e9076d98
SHA1

e069641ff978cbdccbfd8bae7002c203bcee9fde
SHA256

0bc632379f3e05ae529a1c1e72e4b1e878bc95ac8ff67785c57396713c7973e9
SHA512

1865f497291bd994787ec1332219423b8a334df379326eccda99e3931a471a9eae2f7c78cc9717b1aa4119a71d0b8dfbd85f35f0c8538d011c5e516e001bffde
SSDEEP

24576:DJ/o8TTk9wlSZMDJWY6KEsxKMoV0VbXDedVQwJYz/X:DuwqMNQKKMoV0xXDe7QwJYz/X

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2772	ProcessLasso.exe

Loads dropped DLL 6 IoCs

pid	Process
2420	ebb42addcac9fd0f483278f6e9076d98_JaffaCakes118.exe
2420	ebb42addcac9fd0f483278f6e9076d98_JaffaCakes118.exe
2420	ebb42addcac9fd0f483278f6e9076d98_JaffaCakes118.exe
2420	ebb42addcac9fd0f483278f6e9076d98_JaffaCakes118.exe
2420	ebb42addcac9fd0f483278f6e9076d98_JaffaCakes118.exe
2772	ProcessLasso.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebb42addcac9fd0f483278f6e9076d98_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ProcessLasso.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeAssignPrimaryTokenPrivilege	2772	ProcessLasso.exe
Token: SeDebugPrivilege	2772	ProcessLasso.exe
Token: SeChangeNotifyPrivilege	2772	ProcessLasso.exe
Token: SeIncBasePriorityPrivilege	2772	ProcessLasso.exe
Token: SeIncreaseQuotaPrivilege	2772	ProcessLasso.exe
Token: SeCreateGlobalPrivilege	2772	ProcessLasso.exe
Token: SeProfSingleProcessPrivilege	2772	ProcessLasso.exe
Token: SeBackupPrivilege	2772	ProcessLasso.exe
Token: SeRestorePrivilege	2772	ProcessLasso.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 2772	2420	ebb42addcac9fd0f483278f6e9076d98_JaffaCakes118.exe	30
PID 2420 wrote to memory of 2772	2420	ebb42addcac9fd0f483278f6e9076d98_JaffaCakes118.exe	30
PID 2420 wrote to memory of 2772	2420	ebb42addcac9fd0f483278f6e9076d98_JaffaCakes118.exe	30
PID 2420 wrote to memory of 2772	2420	ebb42addcac9fd0f483278f6e9076d98_JaffaCakes118.exe	30
PID 2420 wrote to memory of 2772	2420	ebb42addcac9fd0f483278f6e9076d98_JaffaCakes118.exe	30
PID 2420 wrote to memory of 2772	2420	ebb42addcac9fd0f483278f6e9076d98_JaffaCakes118.exe	30
PID 2420 wrote to memory of 2772	2420	ebb42addcac9fd0f483278f6e9076d98_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\ebb42addcac9fd0f483278f6e9076d98_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ebb42addcac9fd0f483278f6e9076d98_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Users\Admin\AppData\Local\Temp\ProcessLasso.exe
  "C:\Users\Admin\AppData\Local\Temp\ProcessLasso.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\QuickUpgrade.exe.Replacement

Filesize
133KB

MD5
cabd8898d03e910db882da795d141ff7

SHA1
d4c7ed14c83c87d78ff7b132f686b5eb5fc775e2

SHA256
1b9e89f000efade6d880d8127ff28dbbb18801f8ea257c0ba4468cc1279676e7

SHA512
a24f56f5b0234baee7341fe94e115dd09b158514e1766cd2905b653f11c5a655d144ed761e21f50b0188f1679c1dc7e8352be22b5f128d063ebb74038fe84edd

Download Submit
\Users\Admin\AppData\Local\Temp\ProcessLasso.exe

Filesize
664KB

MD5
08d1bfe6ef75397ba154da1265118ee1

SHA1
be15b6f1b0015dc28bd3b10f9730f5c62e2d40a4

SHA256
6b814c0805787f6753b8cb94fcc75640e71ac36c004c300b340af9e1ae77bb89

SHA512
fddff1ea112038f2a051bff43faa743fdc2ba7d6ab57970ba60f4f57b98f88edfe774eb9b5fc26138c9e2c7bbb00887e6fd6e115a1f8dc62a23504a9a354efdc

Download Submit
\Users\Admin\AppData\Local\Temp\pl_rsrc_english.dll

Filesize
412KB

MD5
52ccc229df9cfd690b946c1176fef360

SHA1
15c50f3b8d004f7be414582bfb9fe5a3b4216096

SHA256
510d2a56e4c71a5b25fe26acb90445a167464dce80e0d1c9a80849936fcfe620

SHA512
dfc81a5423679e534a19a1294a2eb51e01b86c9df5edb16eb435bed553d6d528f566e967ec710b7adad9ea57ecdb1762947db07ac0d102f6a29e982427e1b412

Download Submit