Analysis

  • max time kernel
    150s
  • max time network
    103s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/10/2024, 10:24

General

  • Target

    17b4cacaa258654d10cbf083d0d3c350_JaffaCakes118.exe

  • Size

    20KB

  • MD5

    17b4cacaa258654d10cbf083d0d3c350

  • SHA1

    7cb87f63202cde1e18deb0f7d18e8083c9ec2225

  • SHA256

    432d9fbf7c68caf68fce7f533e3d00a2876a1e99bce4168a4946766a8dd4e93e

  • SHA512

    c35b9908dc136fe280a1979c3e4dc956c15ec929fbcb6bbd2a3cd707d048a7880d2db96e0df12213f44552ad0f84930e47112732e154cbee8a341d15f88d3efd

  • SSDEEP

    384:g58AcUoUQKNRYELxQUHDvmk3E+KDvB77777J77c77c77c72qh5eZEKup9Ebir:g5BOFKksO1mE9B77777J77c77c77c71b

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 3 IoCs
  • Executes dropped EXE 5 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • UPX packed file 38 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 48 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Kills process with taskkill 42 IoCs
  • Suspicious use of AdjustPrivilegeToken 42 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\17b4cacaa258654d10cbf083d0d3c350_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\17b4cacaa258654d10cbf083d0d3c350_JaffaCakes118.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3960
    • C:\Windows\SysWOW64\TASKKILL.exe
      TASKKILL /S COMPUTERNAME /F /IM winlogon.exe /T
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:4068
    • C:\Windows\SysWOW64\TASKKILL.exe
      TASKKILL /S COMPUTERNAME /F /IM services.exe /T
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:3260
    • C:\Windows\SysWOW64\TASKKILL.exe
      TASKKILL /S COMPUTERNAME /F /IM lsass.exe /T
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:3888
    • C:\Windows\SysWOW64\TASKKILL.exe
      TASKKILL /S COMPUTERNAME /F /IM csrss.exe /T
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:3984
    • C:\Windows\SysWOW64\TASKKILL.exe
      TASKKILL /S COMPUTERNAME /F /IM smss.exe /T
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:3996
    • C:\Windows\SysWOW64\TASKKILL.exe
      TASKKILL /S COMPUTERNAME /F /IM inetinfo.exe /T
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:4092
    • C:\Windows\SysWOW64\TASKKILL.exe
      TASKKILL /S COMPUTERNAME /F /IM svchost.exe /T
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2988
    • C:\Windows\SysWOW64\TASKKILL.exe
      TASKKILL /S COMPUTERNAME /F /IM winlogon.exe /T
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:4796
    • C:\Windows\SysWOW64\TASKKILL.exe
      TASKKILL /S COMPUTERNAME /F /IM services.exe /T
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:4100
    • C:\Windows\SysWOW64\TASKKILL.exe
      TASKKILL /S COMPUTERNAME /F /IM lsass.exe /T
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:4708
    • C:\Windows\SysWOW64\TASKKILL.exe
      TASKKILL /S COMPUTERNAME /F /IM csrss.exe /T
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:5096
    • C:\Windows\SysWOW64\TASKKILL.exe
      TASKKILL /S COMPUTERNAME /F /IM smss.exe /T
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:4872
    • C:\Windows\SysWOW64\TASKKILL.exe
      TASKKILL /S COMPUTERNAME /F /IM inetinfo.exe /T
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2344
    • C:\Windows\SysWOW64\TASKKILL.exe
      TASKKILL /S COMPUTERNAME /F /IM svchost.exe /T
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:1032
    • C:\Windows\728166.exe
      C:\Windows\728166.exe
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4296
      • C:\Windows\SysWOW64\TASKKILL.exe
        TASKKILL /S COMPUTERNAME /F /IM winlogon.exe /T
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1736
      • C:\Windows\SysWOW64\TASKKILL.exe
        TASKKILL /S COMPUTERNAME /F /IM services.exe /T
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4776
      • C:\Windows\SysWOW64\TASKKILL.exe
        TASKKILL /S COMPUTERNAME /F /IM lsass.exe /T
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:800
      • C:\Windows\SysWOW64\TASKKILL.exe
        TASKKILL /S COMPUTERNAME /F /IM csrss.exe /T
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1496
      • C:\Windows\SysWOW64\TASKKILL.exe
        TASKKILL /S COMPUTERNAME /F /IM smss.exe /T
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3312
      • C:\Windows\SysWOW64\TASKKILL.exe
        TASKKILL /S COMPUTERNAME /F /IM inetinfo.exe /T
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2924
      • C:\Windows\SysWOW64\TASKKILL.exe
        TASKKILL /S COMPUTERNAME /F /IM svchost.exe /T
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2232
      • C:\Windows\SysWOW64\TASKKILL.exe
        TASKKILL /S COMPUTERNAME /F /IM winlogon.exe /T
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3560
      • C:\Windows\SysWOW64\TASKKILL.exe
        TASKKILL /S COMPUTERNAME /F /IM services.exe /T
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1792
      • C:\Windows\SysWOW64\TASKKILL.exe
        TASKKILL /S COMPUTERNAME /F /IM lsass.exe /T
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1744
      • C:\Windows\SysWOW64\TASKKILL.exe
        TASKKILL /S COMPUTERNAME /F /IM csrss.exe /T
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4616
      • C:\Windows\SysWOW64\TASKKILL.exe
        TASKKILL /S COMPUTERNAME /F /IM smss.exe /T
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2996
      • C:\Windows\SysWOW64\TASKKILL.exe
        TASKKILL /S COMPUTERNAME /F /IM inetinfo.exe /T
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1020
      • C:\Windows\SysWOW64\TASKKILL.exe
        TASKKILL /S COMPUTERNAME /F /IM svchost.exe /T
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1440
      • C:\Windows\728166RQSUQW.exe
        C:\Windows\728166RQSUQW.exe
        3⤵
        • Modifies WinLogon for persistence
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:3148
        • C:\Windows\SysWOW64\TASKKILL.exe
          TASKKILL /S COMPUTERNAME /F /IM winlogon.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1992
        • C:\Windows\SysWOW64\TASKKILL.exe
          TASKKILL /S COMPUTERNAME /F /IM services.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4568
        • C:\Windows\SysWOW64\TASKKILL.exe
          TASKKILL /S COMPUTERNAME /F /IM lsass.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2336
        • C:\Windows\SysWOW64\TASKKILL.exe
          TASKKILL /S COMPUTERNAME /F /IM csrss.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2088
        • C:\Windows\SysWOW64\TASKKILL.exe
          TASKKILL /S COMPUTERNAME /F /IM smss.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4780
        • C:\Windows\SysWOW64\TASKKILL.exe
          TASKKILL /S COMPUTERNAME /F /IM inetinfo.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4256
        • C:\Windows\SysWOW64\TASKKILL.exe
          TASKKILL /S COMPUTERNAME /F /IM svchost.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4288
        • C:\Windows\SysWOW64\TASKKILL.exe
          TASKKILL /S COMPUTERNAME /F /IM winlogon.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2956
        • C:\Windows\SysWOW64\TASKKILL.exe
          TASKKILL /S COMPUTERNAME /F /IM services.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4460
        • C:\Windows\SysWOW64\TASKKILL.exe
          TASKKILL /S COMPUTERNAME /F /IM lsass.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1308
        • C:\Windows\SysWOW64\TASKKILL.exe
          TASKKILL /S COMPUTERNAME /F /IM csrss.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1416
        • C:\Windows\SysWOW64\TASKKILL.exe
          TASKKILL /S COMPUTERNAME /F /IM smss.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4200
        • C:\Windows\SysWOW64\TASKKILL.exe
          TASKKILL /S COMPUTERNAME /F /IM inetinfo.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1724
        • C:\Windows\SysWOW64\TASKKILL.exe
          TASKKILL /S COMPUTERNAME /F /IM svchost.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3836
        • C:\Windows\728166RQSUQW.exe
          C:\Windows\728166RQSUQW.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:3592
        • C:\Windows\728166.exe
          C:\Windows\728166.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2576
      • C:\Windows\728166.exe
        C:\Windows\728166.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:4060

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\728166.exe

    Filesize

    16KB

    MD5

    dd8458aedbbd4a0ef1cc0030fe232d87

    SHA1

    425ce52efeed2db6d81d39b7c56555597578ab48

    SHA256

    11dce98da4350436be3a2bd90d320839d418c832883dc81e9f421ba0a9c4919b

    SHA512

    acf84e6a83eaefeea5beda5c000b878e662052964f1a2ec1e755cc3e4cef3b1db4f46c58b3e5939e5428ab9aa8363e8bea1ffdd1fd7c9d6806419f61faf29f72

  • C:\Windows\728166RQSUQW.exe

    Filesize

    18KB

    MD5

    4340708f602a5d64e291e5410594d191

    SHA1

    6512cd9e3a3d154bbc948756bca286855a6e68ac

    SHA256

    a4c683fd1b0f06c08bd975a253922ff830d339752210167e4ff7a8528d0edfd2

    SHA512

    e0e843cac6198c289b519a009aba2c22d3a26378fa9d791e06c42aa63b12728b4a7229dd95903ef2e51bf010b09e5e11d3aeb7e706cf9172e23353083580d5da

  • memory/2576-29-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/3148-41-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/3148-43-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/3148-55-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/3148-57-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/3148-51-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/3148-67-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/3148-39-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/3148-53-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/3148-65-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/3148-49-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/3148-63-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/3148-61-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/3148-45-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/3148-59-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/3148-47-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/3592-23-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/3592-19-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/3960-0-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/3960-37-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/4060-35-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/4296-48-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/4296-52-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/4296-54-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/4296-50-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/4296-56-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/4296-58-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/4296-46-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/4296-44-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/4296-60-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/4296-62-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/4296-42-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/4296-64-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/4296-40-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/4296-66-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/4296-38-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB