ddf5f4c8a00f86665310eb39dd45ef67b6b3144e3e3183481a1239bf6af8c9b8

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08-10-2024 23:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

272cc803c7da5ce616321ea51d06519d_JaffaCakes118.exe
Size

19KB
MD5

272cc803c7da5ce616321ea51d06519d
SHA1

578d724248c6822edc38e27f54dd3542fc1dcc75
SHA256

ddf5f4c8a00f86665310eb39dd45ef67b6b3144e3e3183481a1239bf6af8c9b8
SHA512

e4389c5c20bac02c16da79527b72f4ba69ba82358da059eff0db37b843e28cc0835b14246a137706605cb7773cb85926a1b372ab1714f156788f5eaede9d5080
SSDEEP

384:58/52B2vKkYh1WomtvtdsajasY0trLJmScf5j3iAqo:2/5ekoatV+pszAj5jGo

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2220	272cc803c7da5ce616321ea51d06519d_JaffaCakes118.exe
2220	272cc803c7da5ce616321ea51d06519d_JaffaCakes118.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\wklsdd.dll	272cc803c7da5ce616321ea51d06519d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\tf0	272cc803c7da5ce616321ea51d06519d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\wklsdd.dll.LoG	272cc803c7da5ce616321ea51d06519d_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	272cc803c7da5ce616321ea51d06519d_JaffaCakes118.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\WINDOWS\CURRENTVERSION\EXPLORER	272cc803c7da5ce616321ea51d06519d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\WINDOWS\CURRENTVERSION\EXPLORER\SHELLEXECUTEHOOKS	272cc803c7da5ce616321ea51d06519d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8A3B193-77E3-4FB3-986D-F4FA4828BAFC}\ = "MICROSOFT"	272cc803c7da5ce616321ea51d06519d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8A3B193-77E3-4FB3-986D-F4FA4828BAFC}\InProcServer32\ThreadingModel = "Apartment"	272cc803c7da5ce616321ea51d06519d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELLEXECUTEHOOKS	272cc803c7da5ce616321ea51d06519d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\MICROSOFT	272cc803c7da5ce616321ea51d06519d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\WINDOWS	272cc803c7da5ce616321ea51d06519d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\WINDOWS\CURRENTVERSION	272cc803c7da5ce616321ea51d06519d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\WINDOWS\CURRENTVERSION\EXPLORER\SHELLEXECUTEHOOKS\	272cc803c7da5ce616321ea51d06519d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8A3B193-77E3-4FB3-986D-F4FA4828BAFC}	272cc803c7da5ce616321ea51d06519d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8A3B193-77E3-4FB3-986D-F4FA4828BAFC}\InProcServer32	272cc803c7da5ce616321ea51d06519d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8A3B193-77E3-4FB3-986D-F4FA4828BAFC}\InProcServer32\ = "C:\\Windows\\SysWow64\\wklsdd.dll"	272cc803c7da5ce616321ea51d06519d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE	272cc803c7da5ce616321ea51d06519d_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2220	272cc803c7da5ce616321ea51d06519d_JaffaCakes118.exe
2220	272cc803c7da5ce616321ea51d06519d_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeBackupPrivilege	2220	272cc803c7da5ce616321ea51d06519d_JaffaCakes118.exe
Token: SeRestorePrivilege	2220	272cc803c7da5ce616321ea51d06519d_JaffaCakes118.exe
Token: SeBackupPrivilege	2220	272cc803c7da5ce616321ea51d06519d_JaffaCakes118.exe
Token: SeRestorePrivilege	2220	272cc803c7da5ce616321ea51d06519d_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2220	272cc803c7da5ce616321ea51d06519d_JaffaCakes118.exe
2220	272cc803c7da5ce616321ea51d06519d_JaffaCakes118.exe
2220	272cc803c7da5ce616321ea51d06519d_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\272cc803c7da5ce616321ea51d06519d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\272cc803c7da5ce616321ea51d06519d_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\wklsdd.dll

Filesize
231KB

MD5
8e847b05a492e91f716a4df8742bb9b3

SHA1
3858a2c7129f22878f3cd8f828bbded1e318283b

SHA256
80322a1e6c72e45674259d9a0e710fe3ddc45950a04c401c7d1fb1979c2a4dc4

SHA512
de5f8d825b54f53b19a0d0a7233e6b9f210b03fac928b34002d3b68ff7bdaf4f3db40a866e5cc20669fe85ce418fd15802f29c9788c770eb77b37c0b03e3a3ec

Download Submit
memory/2220-4-0x00000000006C0000-0x00000000006CE000-memory.dmp

Filesize
56KB

Download
memory/2220-8-0x00000000006C0000-0x00000000006CE000-memory.dmp

Filesize
56KB

Download