bd84e3bb83903409176189585358827d1899cb426dc419761aeebf16302bde90

Analysis

max time kernel
95s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20/09/2024, 02:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eca2d6cc205f9390cf1104df6d90aee9_JaffaCakes118.exe
Size

16KB
MD5

eca2d6cc205f9390cf1104df6d90aee9
SHA1

b33d93c847f25c16cb6aef683011398a9a5e59dc
SHA256

bd84e3bb83903409176189585358827d1899cb426dc419761aeebf16302bde90
SHA512

b31033ddba70df8755f2e1c21c1cf83c10e16e5e9cd696af00ae551129d3facc70cb1ae53214a72988aa66fdb67c94dcaf2348d4d21b21bd0412d1bf20a909e6
SSDEEP

384:T1Ox2m64R34KCU4CAvjqEYTT03rWTZKroAEibsrB:T1afpHAfLqEo6AZLAESsN

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\dpvvoxmh.dll = "{00070007-0007-0007-0007-00070007BB15}"	eca2d6cc205f9390cf1104df6d90aee9_JaffaCakes118.exe

Loads dropped DLL 1 IoCs

pid	Process
3448	eca2d6cc205f9390cf1104df6d90aee9_JaffaCakes118.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\dpvvoxmh.tmp	eca2d6cc205f9390cf1104df6d90aee9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\dpvvoxmh.tmp	eca2d6cc205f9390cf1104df6d90aee9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\dpvvoxmh.nls	eca2d6cc205f9390cf1104df6d90aee9_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eca2d6cc205f9390cf1104df6d90aee9_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00070007-0007-0007-0007-00070007BB15}	eca2d6cc205f9390cf1104df6d90aee9_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00070007-0007-0007-0007-00070007BB15}\InProcServer32	eca2d6cc205f9390cf1104df6d90aee9_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00070007-0007-0007-0007-00070007BB15}\InProcServer32\ = "C:\\Windows\\SysWow64\\dpvvoxmh.dll"	eca2d6cc205f9390cf1104df6d90aee9_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00070007-0007-0007-0007-00070007BB15}\InProcServer32\ThreadingModel = "Apartment"	eca2d6cc205f9390cf1104df6d90aee9_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3448	eca2d6cc205f9390cf1104df6d90aee9_JaffaCakes118.exe
3448	eca2d6cc205f9390cf1104df6d90aee9_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3448	eca2d6cc205f9390cf1104df6d90aee9_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3448 wrote to memory of 5048	3448	eca2d6cc205f9390cf1104df6d90aee9_JaffaCakes118.exe	90
PID 3448 wrote to memory of 5048	3448	eca2d6cc205f9390cf1104df6d90aee9_JaffaCakes118.exe	90
PID 3448 wrote to memory of 5048	3448	eca2d6cc205f9390cf1104df6d90aee9_JaffaCakes118.exe	90

C:\Users\Admin\AppData\Local\Temp\eca2d6cc205f9390cf1104df6d90aee9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eca2d6cc205f9390cf1104df6d90aee9_JaffaCakes118.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\E33C.tmp.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\E33C.tmp.bat

Filesize
207B

MD5
bcf847ad5e5bf926889e7878671022ea

SHA1
d1a69dbcb66dace56a1ae8ed927363a1232aa59b

SHA256
70b26f9eb6a1117796619853d44972a4680f294277475730b9ccb5dc14362623

SHA512
5c0ac82376e432961f107cca7df98fe8e581ff8ab3b3315a1b78bb4e6cdda4f2708e118d50330aa79f6105b2d10f98e7739db6d2528f70a9ab988944edc32528

Download Submit
C:\Windows\SysWOW64\dpvvoxmh.tmp

Filesize
999KB

MD5
63ee9cc22d09434a2a18edb714af49c0

SHA1
6334bf8a66efb89a1f3bd5001c7783202ac5287e

SHA256
61cde340ea7e89d82d3bf22345f30be1ead139966ac8cd8c12e8b0dada37e9e0

SHA512
8ec3159e7d764ac1d4dec6ed222e13a267b11af5c488bbbd69537e4effbc90296aff07f184837891d387814d504a17915ad613a313b35e58d91594e578e6ffcc

Download Submit