b63b9ab36b8e6fcaf0c5455c09c76d4db231fdc0fe0077c227b9d61d4a6cd624

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 04:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe
Size

688KB
MD5

2a8c76c149b7b31f27e2533ecbba80bf
SHA1

2036898e4b4eb8a5740e1eb090f6ae61483c5fae
SHA256

b63b9ab36b8e6fcaf0c5455c09c76d4db231fdc0fe0077c227b9d61d4a6cd624
SHA512

f800af2deefa1f4cb620325c8046590ec48b3fb4240fc1bd660d7ee38646d8d451d75baf0a882b00a000ce2590c01824597d244586a3d7b7860ef0e29d19629e
SSDEEP

12288:6F0rjvmwGruGzL8LcKsgMxOYctIg5x4zs0XmVSu/nX1ns4t:6FYT4rnLWFMxnctIgcs0Xi/X6

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

Drops startup file 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scanedisko07.dll	rundll32.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scandisk.lnk	rundll32.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scandisk.lnk	2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scandisk.lnk	rundll32.exe

Impair Defenses: Safe Mode Boot 1 TTPs 6 IoCs

defense_evasion

Safe Mode Boot

T1562.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\WinDefend	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Control\SafeBoot\Minimal\Power	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Control\SafeBoot\Minimal\ProfSvc	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Control\SafeBoot\Minimal\WinDefend	reg.exe

Loads dropped DLL 2 IoCs

pid	Process
1664	rundll32.exe
2196	2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\NvCplDaemonTool = "rundll32.exe C:\\Windows\\system32\\aloadlF8.dll,_IWMPEvents"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\NvCplDaemonTool = "rundll32.exe C:\\Users\\Admin\\aloadlF8.dll,_IWMPEvents"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\NvCplDaemonTool = "rundll32.exe C:\\Windows\\system32\\aloadlF8.dll,_IWMPEvents"	2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\NvCplDaemonTool = "rundll32.exe C:\\Users\\Admin\\aloadlF8.dll,_IWMPEvents"	2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\aloadlF8.dll	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Modifies registry key 1 TTPs 6 IoCs

Modify Registry

T1112

pid	Process
2644	reg.exe
2348	reg.exe
2612	reg.exe
2668	reg.exe
2692	reg.exe
2876	reg.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1664	rundll32.exe
2196	2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1664	rundll32.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2196	2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 1664	2196	2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe	31
PID 2196 wrote to memory of 1664	2196	2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe	31
PID 2196 wrote to memory of 1664	2196	2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe	31
PID 2196 wrote to memory of 1664	2196	2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe	31
PID 2196 wrote to memory of 1664	2196	2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe	31
PID 2196 wrote to memory of 1664	2196	2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe	31
PID 2196 wrote to memory of 1664	2196	2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe	31
PID 2196 wrote to memory of 2876	2196	2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe	32
PID 2196 wrote to memory of 2876	2196	2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe	32
PID 2196 wrote to memory of 2876	2196	2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe	32
PID 2196 wrote to memory of 2876	2196	2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe	32
PID 2196 wrote to memory of 2644	2196	2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe	34
PID 2196 wrote to memory of 2644	2196	2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe	34
PID 2196 wrote to memory of 2644	2196	2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe	34
PID 2196 wrote to memory of 2644	2196	2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe	34
PID 2196 wrote to memory of 2348	2196	2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe	36
PID 2196 wrote to memory of 2348	2196	2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe	36
PID 2196 wrote to memory of 2348	2196	2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe	36
PID 2196 wrote to memory of 2348	2196	2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe	36
PID 2196 wrote to memory of 2612	2196	2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe	37
PID 2196 wrote to memory of 2612	2196	2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe	37
PID 2196 wrote to memory of 2612	2196	2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe	37
PID 2196 wrote to memory of 2612	2196	2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe	37
PID 2196 wrote to memory of 2668	2196	2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe	39
PID 2196 wrote to memory of 2668	2196	2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe	39
PID 2196 wrote to memory of 2668	2196	2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe	39
PID 2196 wrote to memory of 2668	2196	2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe	39
PID 2196 wrote to memory of 2692	2196	2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe	40
PID 2196 wrote to memory of 2692	2196	2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe	40
PID 2196 wrote to memory of 2692	2196	2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe	40
PID 2196 wrote to memory of 2692	2196	2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe	40
PID 2196 wrote to memory of 1600	2196	2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe	43
PID 2196 wrote to memory of 1600	2196	2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe	43
PID 2196 wrote to memory of 1600	2196	2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe	43
PID 2196 wrote to memory of 1600	2196	2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe	43

C:\Users\Admin\AppData\Local\Temp\2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2a8c76c149b7b31f27e2533ecbba80bf_JaffaCakes118.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\CCF0.tmp,_IWMPEvents
  2⤵
  - Drops startup file
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1664
- C:\Windows\SysWOW64\reg.exe
  "C:\Windows\System32\reg.exe" delete HKLM\System\CurrentControlSet\Control\Safeboot /f
  2⤵
  - Impair Defenses: Safe Mode Boot
  - System Location Discovery: System Language Discovery
  - Modifies registry key
  PID:2876
- C:\Windows\SysWOW64\reg.exe
  "C:\Windows\System32\reg.exe" delete HKLM\System\ControlSet001\Control\Safeboot /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry key
  PID:2644
- C:\Windows\SysWOW64\reg.exe
  "C:\Windows\System32\reg.exe" delete HKLM\System\ControlSet002\Control\Safeboot /f
  2⤵
  - Impair Defenses: Safe Mode Boot
  - System Location Discovery: System Language Discovery
  - Modifies registry key
  PID:2348
- C:\Windows\SysWOW64\reg.exe
  "C:\Windows\System32\reg.exe" add HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings /v PrivacyAdvanced /t REG_DWORD /d 1 /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry key
  PID:2612
- C:\Windows\SysWOW64\reg.exe
  "C:\Windows\System32\reg.exe" add HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 /v {A8A88C49-5EB2-4990-A1A2-0876022C854F} /t REG_BINARY /d 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry key
  PID:2668
- C:\Windows\SysWOW64\reg.exe
  "C:\Windows\System32\reg.exe" add HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 /v {AEBA21FA-782A-4A90-978D-B72164C80120} /t REG_BINARY /d 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry key
  PID:2692
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\2A8C76~1.EXE >> NUL
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Impair Defenses

T1562

Safe Mode Boot

T1562.009

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\CCF0.tmp

Filesize
580KB

MD5
d9a94bb51481ebb656569f018bae0d6a

SHA1
facb4322408b323483458ef44c9f6038460b2f25

SHA256
14d5cbec3f0d8a0afadceabd40ff072c802598f0abdebf0ff4dea5dfd3931c06

SHA512
f99c52250a4f69f329b23864f1a5fc09af5e659bf0822a0e18cf75ce421b6c1b85e2ab74b0c5ed8e29a73c37c7c92c18a2162259feb9c8dd64c4a3e6d1455736

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scandisk.lnk

Filesize
1KB

MD5
0e213ab6eb087d61292fadb91a44911e

SHA1
79f97361f10101787b681e75cdbd1f9bac87132b

SHA256
40ee8f82d8cb8cf0f2e38502c374fbe70ab5298765f84f0758c8958eb066ab91

SHA512
145295b086b912522a2c23ba10cb3dcb3878f9306a7e1183a3a242e36d0e02a036a0e1045bc19829abcd6e0f1e96cbdcf2a70e16659bebf8a899b55f0381d8b6

Download Submit
memory/1664-10-0x0000000000260000-0x00000000002DD000-memory.dmp

Filesize
500KB

Download
memory/1664-17-0x0000000000680000-0x00000000006A1000-memory.dmp

Filesize
132KB

Download
memory/1664-12-0x0000000000660000-0x0000000000678000-memory.dmp

Filesize
96KB

Download
memory/1664-8-0x0000000000260000-0x00000000002DD000-memory.dmp

Filesize
500KB

Download
memory/1664-25-0x0000000000680000-0x00000000006A1000-memory.dmp

Filesize
132KB

Download
memory/1664-11-0x0000000000260000-0x00000000002DD000-memory.dmp

Filesize
500KB

Download
memory/1664-23-0x0000000000680000-0x00000000006A1000-memory.dmp

Filesize
132KB

Download
memory/1664-21-0x0000000000680000-0x00000000006A1000-memory.dmp

Filesize
132KB

Download
memory/1664-29-0x0000000000680000-0x00000000006A1000-memory.dmp

Filesize
132KB

Download
memory/1664-30-0x0000000000680000-0x00000000006A1000-memory.dmp

Filesize
132KB

Download
memory/1664-27-0x0000000000680000-0x00000000006A1000-memory.dmp

Filesize
132KB

Download
memory/2196-36-0x0000000000350000-0x00000000003CD000-memory.dmp

Filesize
500KB

Download
memory/2196-59-0x0000000002630000-0x0000000002651000-memory.dmp

Filesize
132KB

Download
memory/2196-3-0x0000000000350000-0x00000000003E4000-memory.dmp

Filesize
592KB

Download
memory/2196-2-0x0000000000490000-0x00000000004A0000-memory.dmp

Filesize
64KB

Download
memory/2196-39-0x0000000000350000-0x00000000003CD000-memory.dmp

Filesize
500KB

Download
memory/2196-49-0x0000000002630000-0x0000000002651000-memory.dmp

Filesize
132KB

Download
memory/2196-45-0x0000000002630000-0x0000000002651000-memory.dmp

Filesize
132KB

Download
memory/2196-40-0x0000000002610000-0x0000000002628000-memory.dmp

Filesize
96KB

Download
memory/2196-0-0x0000000000350000-0x00000000003E4000-memory.dmp

Filesize
592KB

Download
memory/2196-62-0x00000000005A0000-0x00000000005A1000-memory.dmp

Filesize
4KB

Download
memory/2196-51-0x0000000002630000-0x0000000002651000-memory.dmp

Filesize
132KB

Download
memory/2196-1-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2196-58-0x0000000002630000-0x0000000002651000-memory.dmp

Filesize
132KB

Download
memory/2196-57-0x0000000002630000-0x0000000002651000-memory.dmp

Filesize
132KB

Download
memory/2196-55-0x0000000002630000-0x0000000002651000-memory.dmp

Filesize
132KB

Download
memory/2196-53-0x0000000002630000-0x0000000002651000-memory.dmp

Filesize
132KB

Download
memory/2196-65-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2196-64-0x0000000000350000-0x00000000003CD000-memory.dmp

Filesize
500KB

Download
memory/2196-63-0x0000000002630000-0x0000000002651000-memory.dmp

Filesize
132KB

Download
memory/2196-66-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2196-67-0x0000000000350000-0x00000000003CD000-memory.dmp

Filesize
500KB

Download