72d15d14ebd4ab4c6df841e6c1cf19a8b7cd90d41161dd78bd5af84196d3c7b8

Analysis

max time kernel
140s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20/09/2024, 04:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ecd225883d7d08889c557de09a3f7421_JaffaCakes118.exe
Size

531KB
MD5

ecd225883d7d08889c557de09a3f7421
SHA1

cb7ab11bdeaf4387b5e3d3e0785c1a0a8e8213ca
SHA256

72d15d14ebd4ab4c6df841e6c1cf19a8b7cd90d41161dd78bd5af84196d3c7b8
SHA512

4b92c774c48f5215a3ba4a7571dc1ab7a57a85984b6c16a4f60d6d35901a89b42b436cf2e8a36e4623c7b06f352aadc4f790dbd4f934804da268a2239c669150
SSDEEP

12288:G93Wr+LO1WiZWU0di4dBeF3Z4mxxaoEtlK+kt9T2MryYEJL7:GlWr+LTiZWUkiQeQmXzGuyY+L7

Score

10^/10

discovery persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\miTao2.exe"	miTao2.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	miTao2.exe

Deletes itself 1 IoCs

pid	Process
3432	exeA2A8.tmp

Executes dropped EXE 2 IoCs

pid	Process
2584	miTao2.exe
3432	exeA2A8.tmp

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\miTao2.exe	ecd225883d7d08889c557de09a3f7421_JaffaCakes118.exe
File created	C:\Windows\miTao2.exe	ecd225883d7d08889c557de09a3f7421_JaffaCakes118.exe
File opened for modification	C:\Windows\miTao2.exe	miTao2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	exeA2A8.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecd225883d7d08889c557de09a3f7421_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	miTao2.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2584	miTao2.exe
2584	miTao2.exe
2584	miTao2.exe
2584	miTao2.exe
2584	miTao2.exe
2584	miTao2.exe
2584	miTao2.exe
2584	miTao2.exe
2584	miTao2.exe
2584	miTao2.exe
2584	miTao2.exe
2584	miTao2.exe
2584	miTao2.exe
2584	miTao2.exe
2584	miTao2.exe
2584	miTao2.exe
2584	miTao2.exe
2584	miTao2.exe
2584	miTao2.exe
2584	miTao2.exe
2584	miTao2.exe
2584	miTao2.exe
2584	miTao2.exe
2584	miTao2.exe
2584	miTao2.exe
2584	miTao2.exe
2584	miTao2.exe
2584	miTao2.exe
2584	miTao2.exe
2584	miTao2.exe
2584	miTao2.exe
2584	miTao2.exe
2584	miTao2.exe
2584	miTao2.exe
2584	miTao2.exe
2584	miTao2.exe
2584	miTao2.exe
2584	miTao2.exe
2584	miTao2.exe
2584	miTao2.exe
2584	miTao2.exe
2584	miTao2.exe
2584	miTao2.exe
2584	miTao2.exe
2584	miTao2.exe
2584	miTao2.exe
2584	miTao2.exe
2584	miTao2.exe
2584	miTao2.exe
2584	miTao2.exe
2584	miTao2.exe
2584	miTao2.exe
2584	miTao2.exe
2584	miTao2.exe
2584	miTao2.exe
2584	miTao2.exe
2584	miTao2.exe
2584	miTao2.exe
2584	miTao2.exe
2584	miTao2.exe
2584	miTao2.exe
2584	miTao2.exe
2584	miTao2.exe
2584	miTao2.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 5032 wrote to memory of 2584	5032	ecd225883d7d08889c557de09a3f7421_JaffaCakes118.exe	82
PID 5032 wrote to memory of 2584	5032	ecd225883d7d08889c557de09a3f7421_JaffaCakes118.exe	82
PID 5032 wrote to memory of 2584	5032	ecd225883d7d08889c557de09a3f7421_JaffaCakes118.exe	82
PID 5032 wrote to memory of 3432	5032	ecd225883d7d08889c557de09a3f7421_JaffaCakes118.exe	83
PID 5032 wrote to memory of 3432	5032	ecd225883d7d08889c557de09a3f7421_JaffaCakes118.exe	83
PID 5032 wrote to memory of 3432	5032	ecd225883d7d08889c557de09a3f7421_JaffaCakes118.exe	83
PID 2584 wrote to memory of 4444	2584	miTao2.exe	84
PID 2584 wrote to memory of 4444	2584	miTao2.exe	84
PID 2584 wrote to memory of 4444	2584	miTao2.exe	84
PID 4444 wrote to memory of 4624	4444	cmd.exe	86
PID 4444 wrote to memory of 4624	4444	cmd.exe	86
PID 4444 wrote to memory of 4624	4444	cmd.exe	86
PID 4624 wrote to memory of 3064	4624	net.exe	87
PID 4624 wrote to memory of 3064	4624	net.exe	87
PID 4624 wrote to memory of 3064	4624	net.exe	87

C:\Users\Admin\AppData\Local\Temp\ecd225883d7d08889c557de09a3f7421_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ecd225883d7d08889c557de09a3f7421_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Windows\miTao2.exe
  C:\Windows\miTao2.exe
  2⤵
  - Modifies WinLogon for persistence
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2584
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c net stop sharedaccess
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4444
  - - C:\Windows\SysWOW64\net.exe
      net stop sharedaccess
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4624
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop sharedaccess
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3064
- C:\Users\Admin\AppData\Local\Temp\exeA2A8.tmp
  C:\Users\Admin\AppData\Local\Temp\exeA2A8.tmp 604 C:\Users\Admin\AppData\Local\Temp\ECD225~1.EXE
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\miTao2.exe

Filesize
531KB

MD5
ecd225883d7d08889c557de09a3f7421

SHA1
cb7ab11bdeaf4387b5e3d3e0785c1a0a8e8213ca

SHA256
72d15d14ebd4ab4c6df841e6c1cf19a8b7cd90d41161dd78bd5af84196d3c7b8

SHA512
4b92c774c48f5215a3ba4a7571dc1ab7a57a85984b6c16a4f60d6d35901a89b42b436cf2e8a36e4623c7b06f352aadc4f790dbd4f934804da268a2239c669150

Download Submit
memory/2584-30-0x0000000000400000-0x00000000004DC000-memory.dmp

Filesize
880KB

Download
memory/3432-29-0x0000000000400000-0x00000000004DC000-memory.dmp

Filesize
880KB

Download
memory/5032-5-0x0000000002470000-0x0000000002471000-memory.dmp

Filesize
4KB

Download
memory/5032-3-0x0000000002490000-0x0000000002491000-memory.dmp

Filesize
4KB

Download
memory/5032-10-0x0000000002480000-0x0000000002481000-memory.dmp

Filesize
4KB

Download
memory/5032-9-0x00000000024F0000-0x00000000024F1000-memory.dmp

Filesize
4KB

Download
memory/5032-8-0x00000000024C0000-0x00000000024C1000-memory.dmp

Filesize
4KB

Download
memory/5032-7-0x00000000024D0000-0x00000000024D1000-memory.dmp

Filesize
4KB

Download
memory/5032-6-0x0000000002460000-0x0000000002461000-memory.dmp

Filesize
4KB

Download
memory/5032-0-0x0000000000400000-0x00000000004DC000-memory.dmp

Filesize
880KB

Download
memory/5032-4-0x00000000024E0000-0x00000000024E1000-memory.dmp

Filesize
4KB

Download
memory/5032-11-0x0000000003460000-0x0000000003461000-memory.dmp

Filesize
4KB

Download
memory/5032-13-0x00000000034A0000-0x00000000034A1000-memory.dmp

Filesize
4KB

Download
memory/5032-16-0x0000000003470000-0x0000000003471000-memory.dmp

Filesize
4KB

Download
memory/5032-15-0x0000000002230000-0x0000000002231000-memory.dmp

Filesize
4KB

Download
memory/5032-14-0x0000000000680000-0x0000000000681000-memory.dmp

Filesize
4KB

Download
memory/5032-12-0x0000000003450000-0x0000000003453000-memory.dmp

Filesize
12KB

Download
memory/5032-26-0x0000000000400000-0x00000000004DC000-memory.dmp

Filesize
880KB

Download
memory/5032-27-0x00000000022B0000-0x0000000002304000-memory.dmp

Filesize
336KB

Download
memory/5032-2-0x00000000024B0000-0x00000000024B1000-memory.dmp

Filesize
4KB

Download
memory/5032-1-0x00000000022B0000-0x0000000002304000-memory.dmp

Filesize
336KB

Download