d331b8548ec76c04505d52985a492e53b8239bf30fc0913c3f25f452c62c1d40

Analysis

max time kernel
148s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01-10-2024 05:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04868c96c72881660881c17e72abd5ca_JaffaCakes118.exe
Size

31KB
MD5

04868c96c72881660881c17e72abd5ca
SHA1

c0e48416dbd74103cf4ce2ebf1e98948b08e955e
SHA256

d331b8548ec76c04505d52985a492e53b8239bf30fc0913c3f25f452c62c1d40
SHA512

e3ec33f7693d88ad07fbc664d3aaf7fb8c8ca311a76a53b9fbc4e9a1b642585ba7154cf7d5a28a76f20518b351e8b2c1732d099a46c9211a45c937a97c65e38a
SSDEEP

768:4VO0nncHGphfbnX0TP/gmenaigLaQKCMK7oZp:4RuGphfL0TP/gmenaigLaQTM

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4404	oasnp.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	oasnp.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	oasnp.exe
File created	C:\Windows\SysWOW64\oasnp.exe	04868c96c72881660881c17e72abd5ca_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\oasnp.exe	04868c96c72881660881c17e72abd5ca_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	oasnp.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	oasnp.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	04868c96c72881660881c17e72abd5ca_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	oasnp.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	oasnp.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	oasnp.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	oasnp.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	oasnp.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	oasnp.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	oasnp.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	oasnp.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3352	04868c96c72881660881c17e72abd5ca_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3352 wrote to memory of 2972	3352	04868c96c72881660881c17e72abd5ca_JaffaCakes118.exe	83
PID 3352 wrote to memory of 2972	3352	04868c96c72881660881c17e72abd5ca_JaffaCakes118.exe	83
PID 3352 wrote to memory of 2972	3352	04868c96c72881660881c17e72abd5ca_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\04868c96c72881660881c17e72abd5ca_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\04868c96c72881660881c17e72abd5ca_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3352
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\04868C~1.EXE > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2972

C:\Windows\SysWOW64\oasnp.exe
C:\Windows\SysWOW64\oasnp.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\oasnp.exe

Filesize
31KB

MD5
04868c96c72881660881c17e72abd5ca

SHA1
c0e48416dbd74103cf4ce2ebf1e98948b08e955e

SHA256
d331b8548ec76c04505d52985a492e53b8239bf30fc0913c3f25f452c62c1d40

SHA512
e3ec33f7693d88ad07fbc664d3aaf7fb8c8ca311a76a53b9fbc4e9a1b642585ba7154cf7d5a28a76f20518b351e8b2c1732d099a46c9211a45c937a97c65e38a

Download Submit