7db75bb62c483b44f6c61d1c28452a1ec4188d09adf6559b5f4a29306c934629

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02-10-2024 01:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

083a8dbff3b1072ab88ab97892bf85a3_JaffaCakes118.exe
Size

80KB
MD5

083a8dbff3b1072ab88ab97892bf85a3
SHA1

0039d6b1d191e110aef177cf708615ca2b5dd280
SHA256

7db75bb62c483b44f6c61d1c28452a1ec4188d09adf6559b5f4a29306c934629
SHA512

8e4c04e6f4f8ebda3ea763eea9f43738a78591e6823d4195ac9910e46168f6b0afded6758b293b682ed7e4a278eaf31932be2d7045b3d3903408279419842683
SSDEEP

768:gVRkagM5gSE8/kvIRz+G3dw4uoFtOm6svcUVWpv+DL5t64kl1:qka5owkvIRzVw5jUVrxt64kl1

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ntshrui.dll	083a8dbff3b1072ab88ab97892bf85a3_JaffaCakes118.exe
File opened for modification	C:\Windows\ntshrui.dll	083a8dbff3b1072ab88ab97892bf85a3_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	083a8dbff3b1072ab88ab97892bf85a3_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	Explorer.exe

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeAssignPrimaryTokenPrivilege	4752	083a8dbff3b1072ab88ab97892bf85a3_JaffaCakes118.exe
Token: SeAuditPrivilege	4752	083a8dbff3b1072ab88ab97892bf85a3_JaffaCakes118.exe
Token: SeBackupPrivilege	4752	083a8dbff3b1072ab88ab97892bf85a3_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	4752	083a8dbff3b1072ab88ab97892bf85a3_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	4752	083a8dbff3b1072ab88ab97892bf85a3_JaffaCakes118.exe
Token: SeCreatePermanentPrivilege	4752	083a8dbff3b1072ab88ab97892bf85a3_JaffaCakes118.exe
Token: SeCreateTokenPrivilege	4752	083a8dbff3b1072ab88ab97892bf85a3_JaffaCakes118.exe
Token: SeDebugPrivilege	4752	083a8dbff3b1072ab88ab97892bf85a3_JaffaCakes118.exe
Token: SeEnableDelegationPrivilege	4752	083a8dbff3b1072ab88ab97892bf85a3_JaffaCakes118.exe
Token: SeImpersonatePrivilege	4752	083a8dbff3b1072ab88ab97892bf85a3_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	4752	083a8dbff3b1072ab88ab97892bf85a3_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	4752	083a8dbff3b1072ab88ab97892bf85a3_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	4752	083a8dbff3b1072ab88ab97892bf85a3_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	4752	083a8dbff3b1072ab88ab97892bf85a3_JaffaCakes118.exe
Token: SeMachineAccountPrivilege	4752	083a8dbff3b1072ab88ab97892bf85a3_JaffaCakes118.exe
Token: SeManageVolumePrivilege	4752	083a8dbff3b1072ab88ab97892bf85a3_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	4752	083a8dbff3b1072ab88ab97892bf85a3_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	4752	083a8dbff3b1072ab88ab97892bf85a3_JaffaCakes118.exe
Token: SeRestorePrivilege	4752	083a8dbff3b1072ab88ab97892bf85a3_JaffaCakes118.exe
Token: SeSecurityPrivilege	4752	083a8dbff3b1072ab88ab97892bf85a3_JaffaCakes118.exe
Token: SeShutdownPrivilege	4752	083a8dbff3b1072ab88ab97892bf85a3_JaffaCakes118.exe
Token: SeSyncAgentPrivilege	4752	083a8dbff3b1072ab88ab97892bf85a3_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	4752	083a8dbff3b1072ab88ab97892bf85a3_JaffaCakes118.exe
Token: SeSystemtimePrivilege	4752	083a8dbff3b1072ab88ab97892bf85a3_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	4752	083a8dbff3b1072ab88ab97892bf85a3_JaffaCakes118.exe
Token: SeTcbPrivilege	4752	083a8dbff3b1072ab88ab97892bf85a3_JaffaCakes118.exe
Token: SeUndockPrivilege	4752	083a8dbff3b1072ab88ab97892bf85a3_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4752 wrote to memory of 2164	4752	083a8dbff3b1072ab88ab97892bf85a3_JaffaCakes118.exe	84
PID 4752 wrote to memory of 2164	4752	083a8dbff3b1072ab88ab97892bf85a3_JaffaCakes118.exe	84
PID 4752 wrote to memory of 1700	4752	083a8dbff3b1072ab88ab97892bf85a3_JaffaCakes118.exe	86
PID 4752 wrote to memory of 1700	4752	083a8dbff3b1072ab88ab97892bf85a3_JaffaCakes118.exe	86
PID 4752 wrote to memory of 1700	4752	083a8dbff3b1072ab88ab97892bf85a3_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\083a8dbff3b1072ab88ab97892bf85a3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\083a8dbff3b1072ab88ab97892bf85a3_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4752
- C:\Windows\Explorer.exe
  C:\Windows\Explorer.exe
  2⤵
  - Modifies registry class
  PID:2164
- C:\Windows\SysWOW64\cmd.exe
  cmd /c erase "C:\Users\Admin\AppData\Local\Temp\083a8dbff3b1072ab88ab97892bf85a3_JaffaCakes118.exe" /F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads