4597b6e07912428b5e1d935b9a9f582478e8be8bdc7c01c86c4b1a955c253e71

Analysis

max time kernel
146s
max time network
136s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22/10/2024, 04:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
68e03fb8141b5ca32394740d63a3ccd2_JaffaCakes118.exe
Size 1.5MB
Sample241022-ex4vmaxbjb
SHA256 4597b6e07912428b5e1d935b9a9f582478e8be8bdc7c01c86c4b1a955c253e71
MD5 68e03fb8141b5ca32394740d63a3ccd2
SHA1 7811763bdd34ba8acd9332b04a4ae666d85d90da
SHA512 3c488617eab2581ce9f7a3a289cf1af4d5734799cb047936e440a2bcbc986fa259015b97ad705b8ea0d216f5dbfbe70d767e2da57c599c530b0924a344af3afd
SSDEEP 24576:outr5OUGceqtHLqCbn48AGzU574i3aO5arjteAd8GUhQfefFbfgsgtdCTxDET6jh:ouX8qtHuEhrScil5gp5ixhUWRZ/d2IPz
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery evasion persistence privilege_escalation spyware stealer

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\svchost = "C:\\Windows\\svchost.exe"	svchost.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2000	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Control Panel\International\Geo\Nation	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
2944	svchost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Windows directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Teamviewer_Resource_en.dll	68e03fb8141b5ca32394740d63a3ccd2_JaffaCakes118.exe
File created	C:\Windows\TS.dll	68e03fb8141b5ca32394740d63a3ccd2_JaffaCakes118.exe
File created	C:\Windows\__tmp_rar_sfx_access_check_259439709	68e03fb8141b5ca32394740d63a3ccd2_JaffaCakes118.exe
File created	C:\Windows\tv.dll	68e03fb8141b5ca32394740d63a3ccd2_JaffaCakes118.exe
File opened for modification	C:\Windows\tv.dll	68e03fb8141b5ca32394740d63a3ccd2_JaffaCakes118.exe
File created	C:\Windows\svchost.exe	68e03fb8141b5ca32394740d63a3ccd2_JaffaCakes118.exe
File opened for modification	C:\Windows\svchost.exe	68e03fb8141b5ca32394740d63a3ccd2_JaffaCakes118.exe
File created	C:\Windows\Teamviewer_Resource_en.dll	68e03fb8141b5ca32394740d63a3ccd2_JaffaCakes118.exe
File created	C:\Windows\Team.cfg	68e03fb8141b5ca32394740d63a3ccd2_JaffaCakes118.exe
File opened for modification	C:\Windows\TS.dll	68e03fb8141b5ca32394740d63a3ccd2_JaffaCakes118.exe
File opened for modification	C:\Windows\Team.cfg	68e03fb8141b5ca32394740d63a3ccd2_JaffaCakes118.exe
File opened for modification	C:\Windows\Team.cfg	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	68e03fb8141b5ca32394740d63a3ccd2_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 776 wrote to memory of 2944	776	68e03fb8141b5ca32394740d63a3ccd2_JaffaCakes118.exe	30
PID 776 wrote to memory of 2944	776	68e03fb8141b5ca32394740d63a3ccd2_JaffaCakes118.exe	30
PID 776 wrote to memory of 2944	776	68e03fb8141b5ca32394740d63a3ccd2_JaffaCakes118.exe	30
PID 776 wrote to memory of 2944	776	68e03fb8141b5ca32394740d63a3ccd2_JaffaCakes118.exe	30
PID 776 wrote to memory of 2944	776	68e03fb8141b5ca32394740d63a3ccd2_JaffaCakes118.exe	30
PID 776 wrote to memory of 2944	776	68e03fb8141b5ca32394740d63a3ccd2_JaffaCakes118.exe	30
PID 776 wrote to memory of 2944	776	68e03fb8141b5ca32394740d63a3ccd2_JaffaCakes118.exe	30
PID 2944 wrote to memory of 2000	2944	svchost.exe	31
PID 2944 wrote to memory of 2000	2944	svchost.exe	31
PID 2944 wrote to memory of 2000	2944	svchost.exe	31
PID 2944 wrote to memory of 2000	2944	svchost.exe	31

C:\Users\Admin\AppData\Local\Temp\68e03fb8141b5ca32394740d63a3ccd2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\68e03fb8141b5ca32394740d63a3ccd2_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:776
- C:\Windows\svchost.exe
  "C:\Windows\svchost.exe"
  2⤵
  - Adds policy Run key to start application
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2944
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall set allowedprogram C:\Windows\svchost.exe csrss
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:2000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3C3948BE6E525B8A8CEE9FAC91C9E392_EEB8C7E9A435DC539B7A34AD155842C4

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C3948BE6E525B8A8CEE9FAC91C9E392_EEB8C7E9A435DC539B7A34AD155842C4
Size 5B
SHA256 bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
MD5 5bfa51f3a417b98e7443eca90fc94703
SHA1 8c015d80b8a23f780bdd215dc842b0f5551f63bd
SHA512 4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399
MD5 SHA1 SHA512

Submit Download

TS.dll

Path C:\Windows\TS.dll
Size 101KB
SHA256 d0ba014dd468381bd7adc5d72b0d40594ec54945f1ce3030ed97138a1b6008e1
MD5 c91052eb382439559487a39d3572fca3
SHA1 df299887911bcb36ab07f692a863924ecc5c304d
SHA512 5adbc289ed8cb395072fa42539f8afbc026b66e1adaea31ea8d8bc747149ed0e68192856411219f6b1b7ee1aa38cf5e28a82302c192d8d238a817841b80df8ea
SSDEEP 768:cLIdQErfBiOVZUGpKxUxQgKbnlOGGJNFz5opfGqsRn03ltWNlY4L/beFA:fdjgOVZUATlRJ7eJGqSslt6lY4HV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Team.cfg

Path C:\Windows\Team.cfg
Size 340B
SHA256 1b3a839cb5e82db732711f45011deb4dd492245d4d607ae12ad167c364aed98b
MD5 5a5ed3949500d0d00a479b419c05a12b
SHA1 e4a356d6ac57f2009780ea02cc0dfaec62ad42d8
SHA512 17b2be998ee4e1c6ad5e6615633a42600a3c3c08e675fb1189bb6091d6bfce6a652c9082850d812b01e360ee069ef31b2deb3da8703e2be7155fcbab490de30a
MD5 SHA1 SHA512

Submit Download

TeamViewer_Resource_en.DLL

Path C:\Windows\TeamViewer_Resource_en.DLL
Size 653KB
SHA256 9634ecaf469149379bba80a745f53d823948c41ce4e347860701cbdff6935192
MD5 35fa2ce449deb8b93b8ba73bf35e5e7b
SHA1 f93ebb91e0f9a0cf98a362be673d3ca655aded9e
SHA512 cc6644c0bdf95e6b972d5121184e79877f68e7749b0563db8d1e2b55118546760ef90a3e1e4b4f65a837dba5876bfc0cb05b3889fc5d18c731c917f5cf6b0218
SSDEEP 6144:4hmfFy7ZJ0uUCAD06v7JlHZctms+2lifZ0iMe8d6YySkYQKMDqtAu3NhgGy6wShb:4hmf4ACAzneosEi6YhvAuUGyUzyx8
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Windows\svchost.exe
Size 4.2MB
SHA256 904280f20d697d876ab90a1b74c0f22a83b859e8b0519cb411fda26f1642f53e
MD5 9dfa2bd6bddc746acea981da411d59d3
SHA1 81a41c116af135ae25d8bb72baf4b7f6da6b6ec1
SHA512 c335cee9885eab824a5cbb37a00f0dac32c1e2857ad58fb0385d7fce3a1fb74472c0af50beb163765f9707ce705672ed2b657fd513dd790df043201db4df1e99
SSDEEP 49152:UbWfww8Rdi4l5mp5hpnp4/uYrtCk1YjeOvBsduYI/W2DLxZgwSh+EMqazj6xFB1T:T/Cdi4l5q41hCkyDHYKWKZgHBx9H+Y/X
MD5 SHA1 SHA512 SSDEEP

Submit Download

tv.dll

Path C:\Windows\tv.dll
Size 15KB
SHA256 99db84c3042cdfa7d5dc1b429ab6a7d5116aec28a0732e32c5204a17b699cd9f
MD5 291085b8843d0a2ece9b804deb9b9ba2
SHA1 e839cc720dc2c760b3bb6dc92e0d9833b22b9441
SHA512 669584add614fbaff0b980512269759591fa551c5108be5ca7c50bb17c415ea8a78a4769edb10563ee176cc6073aa54e200a702d4825fa33be42119eb4bbece1
SSDEEP 384:OiTg+jSxunOZjWVHR029D7feyZVQnY99VVINcecnjM0M:O3h4GjWBR0CDjhknY9Dwce2jdM
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2944-40-0x0000000000900000-0x0000000000919000-memory.dmp

Download

memory/2944-46-0x0000000000900000-0x0000000000919000-memory.dmp

Download

memory/2944-24-0x0000000077230000-0x0000000077340000-memory.dmp

Download

memory/2944-20-0x0000000000900000-0x0000000000919000-memory.dmp

Download

memory/2944-36-0x0000000077230000-0x0000000077340000-memory.dmp

Download

memory/2944-37-0x00000000003A0000-0x00000000003A7000-memory.dmp

Download

memory/2944-19-0x00000000003A0000-0x00000000003A7000-memory.dmp

Download

memory/2944-39-0x00000000003A0000-0x00000000003A7000-memory.dmp

Download

memory/2944-38-0x0000000010000000-0x00000000100A2000-memory.dmp

Download

memory/2944-42-0x00000000003A0000-0x00000000003A7000-memory.dmp

Download

memory/2944-43-0x0000000000900000-0x0000000000919000-memory.dmp

Download

memory/2944-23-0x0000000077244000-0x0000000077245000-memory.dmp

Download

memory/2944-45-0x00000000003A0000-0x00000000003A7000-memory.dmp

Download

memory/2944-48-0x00000000003A0000-0x00000000003A7000-memory.dmp

Download

memory/2944-51-0x00000000003A0000-0x00000000003A7000-memory.dmp

Download

memory/2944-56-0x00000000003A0000-0x00000000003A7000-memory.dmp

Download

memory/2944-60-0x0000000000900000-0x0000000000919000-memory.dmp

Download

memory/2944-62-0x00000000003A0000-0x00000000003A7000-memory.dmp

Download

memory/2944-63-0x0000000000900000-0x0000000000919000-memory.dmp

Download

memory/2944-65-0x00000000003A0000-0x00000000003A7000-memory.dmp

Download

memory/2944-80-0x00000000003A0000-0x00000000003A7000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads