Analysis
-
max time kernel
150s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
12/10/2024, 16:45
Static task
static1
Behavioral task
behavioral1
Sample
3b104d542f2abc93c712b70e9855486d_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral2
Sample
3b104d542f2abc93c712b70e9855486d_JaffaCakes118.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
General
-
Target
3b104d542f2abc93c712b70e9855486d_JaffaCakes118.exe
-
Size
104KB
-
MD5
3b104d542f2abc93c712b70e9855486d
-
SHA1
fbced2131e1406786cb783ff98ecee28da80719c
-
SHA256
d23c9e0ebb2c57cb968ba7549364b4c8092bcad33e70580f3a32de5f795f39f8
-
SHA512
f210235b9f7b60d472f158c59536e8999ca0a075849b7e4d7bb69e03d7a31a525a5acebd20d453a9326748413d049b234c6b8649f2e20fa60b005fa3c99b8897
-
SSDEEP
768:z5fPp7xkOnk8FX0z1VuInCkTkJsb7ig0qblyb0AqcYxdCW7gBqLm+o6:NPnrFX05VuInCkkAyAAqFdd8umB6
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1132 lsasss.exe -
Drops file in Program Files directory 8 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\System\Ole DB\icuc32.dll lsasss.exe File created C:\Program Files\Common Files\System\Ole DB\icucd32.dll lsasss.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\icucd32.dll lsasss.exe File created C:\Program Files\Common Files\System\ado\lsasss.exe 3b104d542f2abc93c712b70e9855486d_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\System\ado\lsasss.exe 3b104d542f2abc93c712b70e9855486d_JaffaCakes118.exe File created C:\Program Files\Common Files\System\ado\server32.exe 3b104d542f2abc93c712b70e9855486d_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\System\ado\server32.exe 3b104d542f2abc93c712b70e9855486d_JaffaCakes118.exe File created C:\Program Files\Common Files\System\Ole DB\icuc32.dll lsasss.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3b104d542f2abc93c712b70e9855486d_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsasss.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1056 3b104d542f2abc93c712b70e9855486d_JaffaCakes118.exe 1056 3b104d542f2abc93c712b70e9855486d_JaffaCakes118.exe 1056 3b104d542f2abc93c712b70e9855486d_JaffaCakes118.exe 1056 3b104d542f2abc93c712b70e9855486d_JaffaCakes118.exe 1056 3b104d542f2abc93c712b70e9855486d_JaffaCakes118.exe 1056 3b104d542f2abc93c712b70e9855486d_JaffaCakes118.exe 1132 lsasss.exe 1132 lsasss.exe 1132 lsasss.exe 1132 lsasss.exe 1132 lsasss.exe 1132 lsasss.exe 1132 lsasss.exe 1132 lsasss.exe 1132 lsasss.exe 1132 lsasss.exe 1132 lsasss.exe 1132 lsasss.exe 1132 lsasss.exe 1132 lsasss.exe 1132 lsasss.exe 1132 lsasss.exe 1132 lsasss.exe 1132 lsasss.exe 1132 lsasss.exe 1132 lsasss.exe 1132 lsasss.exe 1132 lsasss.exe 1132 lsasss.exe 1132 lsasss.exe 1132 lsasss.exe 1132 lsasss.exe 1132 lsasss.exe 1132 lsasss.exe 1132 lsasss.exe 1132 lsasss.exe 1132 lsasss.exe 1132 lsasss.exe 1132 lsasss.exe 1132 lsasss.exe 1132 lsasss.exe 1132 lsasss.exe 1132 lsasss.exe 1132 lsasss.exe 1132 lsasss.exe 1132 lsasss.exe 1132 lsasss.exe 1132 lsasss.exe 1132 lsasss.exe 1132 lsasss.exe 1132 lsasss.exe 1132 lsasss.exe 1132 lsasss.exe 1132 lsasss.exe 1132 lsasss.exe 1132 lsasss.exe 1132 lsasss.exe 1132 lsasss.exe 1132 lsasss.exe 1132 lsasss.exe 1132 lsasss.exe 1132 lsasss.exe 1132 lsasss.exe 1132 lsasss.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1132 lsasss.exe Token: SeDebugPrivilege 1132 lsasss.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1056 3b104d542f2abc93c712b70e9855486d_JaffaCakes118.exe 1132 lsasss.exe 1132 lsasss.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1056 wrote to memory of 1132 1056 3b104d542f2abc93c712b70e9855486d_JaffaCakes118.exe 84 PID 1056 wrote to memory of 1132 1056 3b104d542f2abc93c712b70e9855486d_JaffaCakes118.exe 84 PID 1056 wrote to memory of 1132 1056 3b104d542f2abc93c712b70e9855486d_JaffaCakes118.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\3b104d542f2abc93c712b70e9855486d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3b104d542f2abc93c712b70e9855486d_JaffaCakes118.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Program Files\Common Files\System\ado\lsasss.exe"C:\Program Files\Common Files\System\ado\lsasss.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1132
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
104KB
MD53b104d542f2abc93c712b70e9855486d
SHA1fbced2131e1406786cb783ff98ecee28da80719c
SHA256d23c9e0ebb2c57cb968ba7549364b4c8092bcad33e70580f3a32de5f795f39f8
SHA512f210235b9f7b60d472f158c59536e8999ca0a075849b7e4d7bb69e03d7a31a525a5acebd20d453a9326748413d049b234c6b8649f2e20fa60b005fa3c99b8897