6381e8f23fe909407102ff050ca560e1e3e87f6f58c75889994370752291f899

Analysis

max time kernel
150s
max time network
147s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27/09/2024, 03:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f9a0bbaa7a34e1ac227c62e2e111bfa6_JaffaCakes118.exe
Size

329KB
MD5

f9a0bbaa7a34e1ac227c62e2e111bfa6
SHA1

93a504c40d73a2b994b6c3654db9fdd805da0f8e
SHA256

6381e8f23fe909407102ff050ca560e1e3e87f6f58c75889994370752291f899
SHA512

474b2a06feb3d503c6499d0c7099659b68dd171bbd4146d862af2f9cafa51d60333a075f253abdca956bc89020a34fe95194b698b2b15fcb1bdbe3e5e9f78e7d
SSDEEP

6144:IeGT0fZWGE/Z3RvXQNt4LAG+ybL+qUBfmr5vcUe06yk+IjdHS:IeWwW7/Z3RvXQr4sGVth206NhjdHS

Score

7^/10

discovery persistence upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2312	cA19600AgFoC19600.exe

Executes dropped EXE 1 IoCs

pid	Process
2312	cA19600AgFoC19600.exe

Loads dropped DLL 2 IoCs

pid	Process
2236	f9a0bbaa7a34e1ac227c62e2e111bfa6_JaffaCakes118.exe
2236	f9a0bbaa7a34e1ac227c62e2e111bfa6_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\cA19600AgFoC19600 = "C:\\ProgramData\\cA19600AgFoC19600\\cA19600AgFoC19600.exe"	cA19600AgFoC19600.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2236-4-0x0000000000400000-0x00000000004CB000-memory.dmp	upx
behavioral1/memory/2236-3-0x0000000000400000-0x00000000004CB000-memory.dmp	upx
behavioral1/memory/2236-1-0x0000000000400000-0x00000000004CB000-memory.dmp	upx
behavioral1/memory/2236-5-0x0000000000400000-0x00000000004CB000-memory.dmp	upx
behavioral1/memory/2236-15-0x0000000000400000-0x00000000004CB000-memory.dmp	upx
behavioral1/memory/2236-36-0x0000000000400000-0x00000000004CB000-memory.dmp	upx
behavioral1/memory/2312-41-0x0000000000400000-0x00000000004CB000-memory.dmp	upx
behavioral1/memory/2312-47-0x0000000000400000-0x00000000004CB000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f9a0bbaa7a34e1ac227c62e2e111bfa6_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cA19600AgFoC19600.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2236	f9a0bbaa7a34e1ac227c62e2e111bfa6_JaffaCakes118.exe
2236	f9a0bbaa7a34e1ac227c62e2e111bfa6_JaffaCakes118.exe
2236	f9a0bbaa7a34e1ac227c62e2e111bfa6_JaffaCakes118.exe
2236	f9a0bbaa7a34e1ac227c62e2e111bfa6_JaffaCakes118.exe
2236	f9a0bbaa7a34e1ac227c62e2e111bfa6_JaffaCakes118.exe
2236	f9a0bbaa7a34e1ac227c62e2e111bfa6_JaffaCakes118.exe
2236	f9a0bbaa7a34e1ac227c62e2e111bfa6_JaffaCakes118.exe
2236	f9a0bbaa7a34e1ac227c62e2e111bfa6_JaffaCakes118.exe
2236	f9a0bbaa7a34e1ac227c62e2e111bfa6_JaffaCakes118.exe
2236	f9a0bbaa7a34e1ac227c62e2e111bfa6_JaffaCakes118.exe
2236	f9a0bbaa7a34e1ac227c62e2e111bfa6_JaffaCakes118.exe
2236	f9a0bbaa7a34e1ac227c62e2e111bfa6_JaffaCakes118.exe
2236	f9a0bbaa7a34e1ac227c62e2e111bfa6_JaffaCakes118.exe
2236	f9a0bbaa7a34e1ac227c62e2e111bfa6_JaffaCakes118.exe
2236	f9a0bbaa7a34e1ac227c62e2e111bfa6_JaffaCakes118.exe
2236	f9a0bbaa7a34e1ac227c62e2e111bfa6_JaffaCakes118.exe
2236	f9a0bbaa7a34e1ac227c62e2e111bfa6_JaffaCakes118.exe
2236	f9a0bbaa7a34e1ac227c62e2e111bfa6_JaffaCakes118.exe
2236	f9a0bbaa7a34e1ac227c62e2e111bfa6_JaffaCakes118.exe
2236	f9a0bbaa7a34e1ac227c62e2e111bfa6_JaffaCakes118.exe
2236	f9a0bbaa7a34e1ac227c62e2e111bfa6_JaffaCakes118.exe
2236	f9a0bbaa7a34e1ac227c62e2e111bfa6_JaffaCakes118.exe
2236	f9a0bbaa7a34e1ac227c62e2e111bfa6_JaffaCakes118.exe
2236	f9a0bbaa7a34e1ac227c62e2e111bfa6_JaffaCakes118.exe
2236	f9a0bbaa7a34e1ac227c62e2e111bfa6_JaffaCakes118.exe
2236	f9a0bbaa7a34e1ac227c62e2e111bfa6_JaffaCakes118.exe
2236	f9a0bbaa7a34e1ac227c62e2e111bfa6_JaffaCakes118.exe
2236	f9a0bbaa7a34e1ac227c62e2e111bfa6_JaffaCakes118.exe
2236	f9a0bbaa7a34e1ac227c62e2e111bfa6_JaffaCakes118.exe
2236	f9a0bbaa7a34e1ac227c62e2e111bfa6_JaffaCakes118.exe
2236	f9a0bbaa7a34e1ac227c62e2e111bfa6_JaffaCakes118.exe
2236	f9a0bbaa7a34e1ac227c62e2e111bfa6_JaffaCakes118.exe
2236	f9a0bbaa7a34e1ac227c62e2e111bfa6_JaffaCakes118.exe
2236	f9a0bbaa7a34e1ac227c62e2e111bfa6_JaffaCakes118.exe
2236	f9a0bbaa7a34e1ac227c62e2e111bfa6_JaffaCakes118.exe
2236	f9a0bbaa7a34e1ac227c62e2e111bfa6_JaffaCakes118.exe
2236	f9a0bbaa7a34e1ac227c62e2e111bfa6_JaffaCakes118.exe
2236	f9a0bbaa7a34e1ac227c62e2e111bfa6_JaffaCakes118.exe
2236	f9a0bbaa7a34e1ac227c62e2e111bfa6_JaffaCakes118.exe
2236	f9a0bbaa7a34e1ac227c62e2e111bfa6_JaffaCakes118.exe
2236	f9a0bbaa7a34e1ac227c62e2e111bfa6_JaffaCakes118.exe
2236	f9a0bbaa7a34e1ac227c62e2e111bfa6_JaffaCakes118.exe
2236	f9a0bbaa7a34e1ac227c62e2e111bfa6_JaffaCakes118.exe
2236	f9a0bbaa7a34e1ac227c62e2e111bfa6_JaffaCakes118.exe
2236	f9a0bbaa7a34e1ac227c62e2e111bfa6_JaffaCakes118.exe
2236	f9a0bbaa7a34e1ac227c62e2e111bfa6_JaffaCakes118.exe
2236	f9a0bbaa7a34e1ac227c62e2e111bfa6_JaffaCakes118.exe
2236	f9a0bbaa7a34e1ac227c62e2e111bfa6_JaffaCakes118.exe
2236	f9a0bbaa7a34e1ac227c62e2e111bfa6_JaffaCakes118.exe
2236	f9a0bbaa7a34e1ac227c62e2e111bfa6_JaffaCakes118.exe
2236	f9a0bbaa7a34e1ac227c62e2e111bfa6_JaffaCakes118.exe
2236	f9a0bbaa7a34e1ac227c62e2e111bfa6_JaffaCakes118.exe
2236	f9a0bbaa7a34e1ac227c62e2e111bfa6_JaffaCakes118.exe
2236	f9a0bbaa7a34e1ac227c62e2e111bfa6_JaffaCakes118.exe
2236	f9a0bbaa7a34e1ac227c62e2e111bfa6_JaffaCakes118.exe
2236	f9a0bbaa7a34e1ac227c62e2e111bfa6_JaffaCakes118.exe
2236	f9a0bbaa7a34e1ac227c62e2e111bfa6_JaffaCakes118.exe
2236	f9a0bbaa7a34e1ac227c62e2e111bfa6_JaffaCakes118.exe
2236	f9a0bbaa7a34e1ac227c62e2e111bfa6_JaffaCakes118.exe
2236	f9a0bbaa7a34e1ac227c62e2e111bfa6_JaffaCakes118.exe
2236	f9a0bbaa7a34e1ac227c62e2e111bfa6_JaffaCakes118.exe
2236	f9a0bbaa7a34e1ac227c62e2e111bfa6_JaffaCakes118.exe
2236	f9a0bbaa7a34e1ac227c62e2e111bfa6_JaffaCakes118.exe
2236	f9a0bbaa7a34e1ac227c62e2e111bfa6_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2236	f9a0bbaa7a34e1ac227c62e2e111bfa6_JaffaCakes118.exe
Token: SeDebugPrivilege	2312	cA19600AgFoC19600.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2312	2236	f9a0bbaa7a34e1ac227c62e2e111bfa6_JaffaCakes118.exe	33
PID 2236 wrote to memory of 2312	2236	f9a0bbaa7a34e1ac227c62e2e111bfa6_JaffaCakes118.exe	33
PID 2236 wrote to memory of 2312	2236	f9a0bbaa7a34e1ac227c62e2e111bfa6_JaffaCakes118.exe	33
PID 2236 wrote to memory of 2312	2236	f9a0bbaa7a34e1ac227c62e2e111bfa6_JaffaCakes118.exe	33

C:\Users\Admin\AppData\Local\Temp\f9a0bbaa7a34e1ac227c62e2e111bfa6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f9a0bbaa7a34e1ac227c62e2e111bfa6_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2236
- C:\ProgramData\cA19600AgFoC19600\cA19600AgFoC19600.exe
  "C:\ProgramData\cA19600AgFoC19600\cA19600AgFoC19600.exe" "C:\Users\Admin\AppData\Local\Temp\f9a0bbaa7a34e1ac227c62e2e111bfa6_JaffaCakes118.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\cA19600AgFoC19600\cA19600AgFoC19600

Filesize
208B

MD5
c987c2bda11613577bc7b627a04499e7

SHA1
50389892ede9cf3979d3dd0835e10a17f61663a5

SHA256
93b1f04814b73e7215eb0ebb08be2bc8bacade400225f3015ec616b1ce11df39

SHA512
6c1009b7037521a45ce78fa4e93ca40d708c63212b418f6a8cd73a1bd119052ac884b84d955006b80a1fe174d50b4ddb26361e3a16416895677019b5408ae078

Download Submit
\ProgramData\cA19600AgFoC19600\cA19600AgFoC19600.exe

Filesize
329KB

MD5
e5b6af73ea6e976eff1c7462e4a32018

SHA1
4796e3b72e493d8fbb67dc56967730a52f497f52

SHA256
9252015fc0d6fe7f8fd78bc94f6543ce637810f1b57e1225903b9cec9bf8de17

SHA512
f2984a3abf64a7207370c59a30c8eb7eccb58f73973fa856130b8ac5ffc66adb3336c63172236d352eb706834f822a6f5eebde71eec8b00fba3cd2533d6fc6e0

Download Submit
memory/2236-14-0x00000000004C8000-0x00000000004C9000-memory.dmp

Filesize
4KB

Download
memory/2236-1-0x0000000000400000-0x00000000004CB000-memory.dmp

Filesize
812KB

Download
memory/2236-2-0x0000000000400000-0x00000000004CB000-memory.dmp

Filesize
812KB

Download
memory/2236-5-0x0000000000400000-0x00000000004CB000-memory.dmp

Filesize
812KB

Download
memory/2236-0-0x00000000004C8000-0x00000000004C9000-memory.dmp

Filesize
4KB

Download
memory/2236-15-0x0000000000400000-0x00000000004CB000-memory.dmp

Filesize
812KB

Download
memory/2236-3-0x0000000000400000-0x00000000004CB000-memory.dmp

Filesize
812KB

Download
memory/2236-36-0x0000000000400000-0x00000000004CB000-memory.dmp

Filesize
812KB

Download
memory/2236-4-0x0000000000400000-0x00000000004CB000-memory.dmp

Filesize
812KB

Download
memory/2312-41-0x0000000000400000-0x00000000004CB000-memory.dmp

Filesize
812KB

Download
memory/2312-47-0x0000000000400000-0x00000000004CB000-memory.dmp

Filesize
812KB

Download