b4aa19483809153aa5c5ff0552b6efd3ffbc27ab67743cfb1767758f0052f60e

General

Target
0477e51cdb8225d064876a7a01735775_JaffaCakes118.exe
Size 84KB
Sample241001-fsce9asblp
SHA256 b4aa19483809153aa5c5ff0552b6efd3ffbc27ab67743cfb1767758f0052f60e
MD5 0477e51cdb8225d064876a7a01735775
SHA1 1d6929959c53f112c808862c10c7adb9049a5f2d
SHA512 3f65864476edb97ff43142d12ebaef0df6e16bf683a94f4595dd2aa0d9b3502c24e538353455b05d7b6203b3268794aff38448d4264f0b161c459c3c851456e5
SSDEEP 768:4abKiqioa1ZHaP4CO+ycrc3D7XoGVPXoSlcdIwK+fARvWJXNV/bKOZaIcWoMGkJg:4abVtZHaP4Iw/zwXPbFbKOZWiGkb
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
1008	icacls.exe
412	takeown.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
412	takeown.exe
1008	icacls.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ole.dll	0477e51cdb8225d064876a7a01735775_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\imm32.dll.log	0477e51cdb8225d064876a7a01735775_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\imm32.dll.log	0477e51cdb8225d064876a7a01735775_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\imm32.dll	0477e51cdb8225d064876a7a01735775_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0477e51cdb8225d064876a7a01735775_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
964	taskkill.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1908	0477e51cdb8225d064876a7a01735775_JaffaCakes118.exe
1908	0477e51cdb8225d064876a7a01735775_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1908	0477e51cdb8225d064876a7a01735775_JaffaCakes118.exe
Token: SeDebugPrivilege	964	taskkill.exe
Token: SeTakeOwnershipPrivilege	412	takeown.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1908	0477e51cdb8225d064876a7a01735775_JaffaCakes118.exe
1908	0477e51cdb8225d064876a7a01735775_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 964	1908	0477e51cdb8225d064876a7a01735775_JaffaCakes118.exe	82
PID 1908 wrote to memory of 964	1908	0477e51cdb8225d064876a7a01735775_JaffaCakes118.exe	82
PID 1908 wrote to memory of 964	1908	0477e51cdb8225d064876a7a01735775_JaffaCakes118.exe	82
PID 1908 wrote to memory of 412	1908	0477e51cdb8225d064876a7a01735775_JaffaCakes118.exe	85
PID 1908 wrote to memory of 412	1908	0477e51cdb8225d064876a7a01735775_JaffaCakes118.exe	85
PID 1908 wrote to memory of 412	1908	0477e51cdb8225d064876a7a01735775_JaffaCakes118.exe	85
PID 1908 wrote to memory of 1008	1908	0477e51cdb8225d064876a7a01735775_JaffaCakes118.exe	87
PID 1908 wrote to memory of 1008	1908	0477e51cdb8225d064876a7a01735775_JaffaCakes118.exe	87
PID 1908 wrote to memory of 1008	1908	0477e51cdb8225d064876a7a01735775_JaffaCakes118.exe	87
PID 1908 wrote to memory of 1040	1908	0477e51cdb8225d064876a7a01735775_JaffaCakes118.exe	89
PID 1908 wrote to memory of 1040	1908	0477e51cdb8225d064876a7a01735775_JaffaCakes118.exe	89
PID 1908 wrote to memory of 1040	1908	0477e51cdb8225d064876a7a01735775_JaffaCakes118.exe	89

C:\Users\Admin\AppData\Local\Temp\0477e51cdb8225d064876a7a01735775_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0477e51cdb8225d064876a7a01735775_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM NVCAgent.npc
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:964
- C:\Windows\SysWOW64\takeown.exe
  takeown /F C:\Windows\system32\imm32.dll
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:412
- C:\Windows\SysWOW64\icacls.exe
  icacls C:\Windows\system32\imm32.dll /grant administrators:f
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - System Location Discovery: System Language Discovery
  PID:1008
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\clr_e57cf08.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

1

T1222

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

clr_e57cf08.bat

Path \??\c:\clr_e57cf08.bat
Size 238B
SHA256 718158cef207c29bd68ff64f7e778c82a1bacaa46d203c8d645156a3180089b8
MD5 fe1572f9b39f298b1fe1904cd136b64b
SHA1 292b9a539f75f0c37d6184da767e1e38f4d18810
SHA512 27ad57e9d133b9a251b5e61448bcf86c09b2ad02da04dbae76f2af7eee96af8052284092a429905e32bbf9a408e5b4778d5b2b529a621b867b1f3b0415fcc96d
MD5 SHA1 SHA512

Submit Download

memory/1908-9-0x0000000076190000-0x00000000761B5000-memory.dmp

Download

Analysis

Sharing