dc182c05f3d1b2710d167128eaffa5ff77764bdd359524947fe874826a8bd637

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30-09-2024 20:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe
Size

491KB
MD5

0318050dc1f2db4decb1c35ff14c9f20
SHA1

9cd145edf40dc7103a62d7ea37eb48c742b87c78
SHA256

dc182c05f3d1b2710d167128eaffa5ff77764bdd359524947fe874826a8bd637
SHA512

ce8515d2b7a01877cb5d9734eaad561acf12e4f433e1e0d2c47f8d263adf0603a1c1e4f9b0f2d0725e588b2f5aa8339c1302fb8622ab76053ee34790361f7aca
SSDEEP

6144:aS6vcuW4uS/r8I69xfskGcIUuwdqIeoQzJPyJssJ4R/kM4fdFN5/UAPeXcFcU13U:aob4uhB9NsknLSHlQ3T5sAPGM1FTdTc

Score

7^/10

discovery upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2128	cmd.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\SysWOW64\taskmar.exe	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe
File opened for modification	C:\WINDOWS\SysWOW64\taskmar.exe	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1960-0-0x0000000000400000-0x000000000051F000-memory.dmp	upx
behavioral1/memory/1960-9-0x0000000000400000-0x000000000051F000-memory.dmp	upx
behavioral1/memory/1960-10-0x0000000000400000-0x000000000051F000-memory.dmp	upx
behavioral1/memory/1960-20-0x0000000000400000-0x000000000051F000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Kills process with taskkill 3 IoCs

evasion

pid	Process
1060	taskkill.exe
2800	taskkill.exe
2832	taskkill.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefiles\shell	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefiles\shell\open	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefiles\shell\open\command\ = "\"C:\\WINDOWS\\system32\\taskmar.exe\" \"%1\""	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe\ = "exefiles"	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefiles\DefaultIcon	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefiles	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefiles\DefaultIcon\ = "%1"	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefiles\shell\open\command	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: 33	1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe
Token: 33	1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe
Token: 33	1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe
Token: 33	1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe
Token: 33	1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe
Token: 33	1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe
Token: 33	1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe
Token: 33	1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe
Token: 33	1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe
Token: 33	1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe
Token: 33	1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe
Token: 33	1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe
Token: 33	1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe
Token: 33	1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe
Token: 33	1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe
Token: 33	1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe
Token: 33	1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe
Token: 33	1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe
Token: 33	1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe
Token: 33	1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe
Token: SeDebugPrivilege	2800	taskkill.exe
Token: 33	1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe
Token: 33	1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe
Token: 33	1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe
Token: 33	1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe
Token: 33	1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe
Token: 33	1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe
Token: 33	1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe
Token: 33	1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe
Token: 33	1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe
Token: 33	1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe
Token: 33	1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe
Token: 33	1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
776	DllHost.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe
1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 2800	1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe	32
PID 1960 wrote to memory of 2800	1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe	32
PID 1960 wrote to memory of 2800	1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe	32
PID 1960 wrote to memory of 2800	1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe	32
PID 1960 wrote to memory of 2832	1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe	36
PID 1960 wrote to memory of 2832	1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe	36
PID 1960 wrote to memory of 2832	1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe	36
PID 1960 wrote to memory of 2832	1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe	36
PID 1960 wrote to memory of 2128	1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe	38
PID 1960 wrote to memory of 2128	1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe	38
PID 1960 wrote to memory of 2128	1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe	38
PID 1960 wrote to memory of 2128	1960	0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe	38
PID 2128 wrote to memory of 1060	2128	cmd.exe	40
PID 2128 wrote to memory of 1060	2128	cmd.exe	40
PID 2128 wrote to memory of 1060	2128	cmd.exe	40
PID 2128 wrote to memory of 1060	2128	cmd.exe	40

C:\Users\Admin\AppData\Local\Temp\0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im ZhuDongFangYu.exe /t
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2800
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im QQ.exe /t
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  PID:2832
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\0.bat
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2128
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im 0318050dc1f2db4decb1c35ff14c9f20_JaffaCakes118.exe /t
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:1060

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\0.bat

Filesize
281B

MD5
957c2367bd1fd1e56c5bacbb4a059bf6

SHA1
5dd116b0913a7214f42c215a55056c0812a020c7

SHA256
e618125efefd60ff6f7c5b60f08ccbf36b51e3b772e5caf762afb2a66a5d1e8c

SHA512
3d8c926717c9c415fabf38b37324140675c084ad3891c840b841f7671b6ad915a01fb73b4e05c00f68fbf53530b4c523030c189fb040c30120ffe7863d1232a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\ÃÀÅ®Í¼Æ¬.jpg

Filesize
164KB

MD5
fc16b42489f4cfd99a6e1c07f5c810f6

SHA1
76e8615e467b5fb1fb15f6d5a429cae437fdac95

SHA256
084a2530021858a57561c09bfe7fa18a26555b14893cc40ee42970b3c07e75ef

SHA512
caee88860e772af113e90b14e159a81d6b431fdaad6fff4a89e7fcda6ed49b1780059d8180a26292cda1a675e24f1d33fc20a604a926077374da168b9f72a421

Download Submit
memory/776-4-0x0000000000160000-0x0000000000162000-memory.dmp

Filesize
8KB

Download
memory/776-5-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/776-11-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1960-0-0x0000000000400000-0x000000000051F000-memory.dmp

Filesize
1.1MB

Download
memory/1960-3-0x00000000036A0000-0x00000000036A2000-memory.dmp

Filesize
8KB

Download
memory/1960-9-0x0000000000400000-0x000000000051F000-memory.dmp

Filesize
1.1MB

Download
memory/1960-10-0x0000000000400000-0x000000000051F000-memory.dmp

Filesize
1.1MB

Download
memory/1960-20-0x0000000000400000-0x000000000051F000-memory.dmp

Filesize
1.1MB

Download