14da649d3088110d0f07c9f3708eb6a136c17ef7b357a2c46314383b8c985616

Analysis

max time kernel
143s
max time network
144s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
31/10/2024, 08:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

82741ce8678a439fabcb3566c0439df4_JaffaCakes118.exe
Size

595KB
MD5

82741ce8678a439fabcb3566c0439df4
SHA1

0de43b6124d296f987e8577836071f87f931b912
SHA256

14da649d3088110d0f07c9f3708eb6a136c17ef7b357a2c46314383b8c985616
SHA512

f36b39f6005101f09fed500a293aa61c97f427eab39a50f49043d2c2d3f134610e9456675b777b481a034132e9ce610581bb08038db4f82eff510f918ef9ebb1
SSDEEP

12288:mQzumgSC/e90MuutyDQODCX7kLpbNF3Z4mxxLDqVTVOCO:mQzMzemMNeQOS65QmXCVTzO

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2916	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2724	svchost.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	svchost.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\svchost.exe	82741ce8678a439fabcb3566c0439df4_JaffaCakes118.exe
File opened for modification	C:\Windows\svchost.exe	82741ce8678a439fabcb3566c0439df4_JaffaCakes118.exe
File created	C:\Windows\uninstal.bat	82741ce8678a439fabcb3566c0439df4_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	82741ce8678a439fabcb3566c0439df4_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies data under HKEY_USERS 28 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-5a-6f-e4-49-a1	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-5a-6f-e4-49-a1\WpadDecisionTime = 809e90c3702bdb01	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B7B60526-805D-4A8F-892C-1590B88E0A0E}\WpadDecisionReason = "1"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B7B60526-805D-4A8F-892C-1590B88E0A0E}\WpadNetworkName = "Network 3"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-5a-6f-e4-49-a1\WpadDecision = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-5a-6f-e4-49-a1\WpadDecisionTime = a0dd1b8e702bdb01	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0085000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0085000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B7B60526-805D-4A8F-892C-1590B88E0A0E}\72-5a-6f-e4-49-a1	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-5a-6f-e4-49-a1\WpadDecisionReason = "1"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-5a-6f-e4-49-a1\WpadDetectedUrl	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B7B60526-805D-4A8F-892C-1590B88E0A0E}\WpadDecision = "0"	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B7B60526-805D-4A8F-892C-1590B88E0A0E}\WpadDecisionTime = 809e90c3702bdb01	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B7B60526-805D-4A8F-892C-1590B88E0A0E}	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B7B60526-805D-4A8F-892C-1590B88E0A0E}\WpadDecisionTime = a0dd1b8e702bdb01	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	svchost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1064	82741ce8678a439fabcb3566c0439df4_JaffaCakes118.exe
Token: SeDebugPrivilege	2724	svchost.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2724	svchost.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1064 wrote to memory of 2916	1064	82741ce8678a439fabcb3566c0439df4_JaffaCakes118.exe	31
PID 1064 wrote to memory of 2916	1064	82741ce8678a439fabcb3566c0439df4_JaffaCakes118.exe	31
PID 1064 wrote to memory of 2916	1064	82741ce8678a439fabcb3566c0439df4_JaffaCakes118.exe	31
PID 1064 wrote to memory of 2916	1064	82741ce8678a439fabcb3566c0439df4_JaffaCakes118.exe	31
PID 1064 wrote to memory of 2916	1064	82741ce8678a439fabcb3566c0439df4_JaffaCakes118.exe	31
PID 1064 wrote to memory of 2916	1064	82741ce8678a439fabcb3566c0439df4_JaffaCakes118.exe	31
PID 1064 wrote to memory of 2916	1064	82741ce8678a439fabcb3566c0439df4_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\82741ce8678a439fabcb3566c0439df4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\82741ce8678a439fabcb3566c0439df4_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1064
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\uninstal.bat
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2916

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\svchost.exe

Filesize
595KB

MD5
82741ce8678a439fabcb3566c0439df4

SHA1
0de43b6124d296f987e8577836071f87f931b912

SHA256
14da649d3088110d0f07c9f3708eb6a136c17ef7b357a2c46314383b8c985616

SHA512
f36b39f6005101f09fed500a293aa61c97f427eab39a50f49043d2c2d3f134610e9456675b777b481a034132e9ce610581bb08038db4f82eff510f918ef9ebb1

Download Submit
C:\Windows\uninstal.bat

Filesize
218B

MD5
68bc222ae09b0e7e008311f70570a67b

SHA1
b5432264a3d83567e5e1854ea1ba4a655fb79dd9

SHA256
c4be9d0255a2d0d4bb3c4787505618b556b13ca93f75552379f8f9416cf1b820

SHA512
ecc082253f6ce3754897aa374d238044423ca05ede8955a4e8e46099dfd8c03a036d5e280874e240439b2963e9766311997f348ba81f002da476af718f3dfd96

Download Submit
memory/1064-13-0x00000000032B0000-0x00000000032B1000-memory.dmp

Filesize
4KB

Download
memory/1064-11-0x00000000032C0000-0x00000000032C1000-memory.dmp

Filesize
4KB

Download
memory/1064-25-0x00000000032B0000-0x00000000032B1000-memory.dmp

Filesize
4KB

Download
memory/1064-24-0x00000000032B0000-0x00000000032B1000-memory.dmp

Filesize
4KB

Download
memory/1064-23-0x00000000032B0000-0x00000000032B1000-memory.dmp

Filesize
4KB

Download
memory/1064-22-0x00000000032B0000-0x00000000032B1000-memory.dmp

Filesize
4KB

Download
memory/1064-21-0x00000000032B0000-0x00000000032B1000-memory.dmp

Filesize
4KB

Download
memory/1064-20-0x00000000032B0000-0x00000000032B1000-memory.dmp

Filesize
4KB

Download
memory/1064-19-0x00000000032B0000-0x00000000032B1000-memory.dmp

Filesize
4KB

Download
memory/1064-18-0x00000000032B0000-0x00000000032B1000-memory.dmp

Filesize
4KB

Download
memory/1064-17-0x00000000032B0000-0x00000000032B1000-memory.dmp

Filesize
4KB

Download
memory/1064-16-0x00000000032B0000-0x00000000032B1000-memory.dmp

Filesize
4KB

Download
memory/1064-15-0x00000000032B0000-0x00000000032B1000-memory.dmp

Filesize
4KB

Download
memory/1064-14-0x00000000032B0000-0x00000000032B1000-memory.dmp

Filesize
4KB

Download
memory/1064-26-0x00000000032B0000-0x00000000032B1000-memory.dmp

Filesize
4KB

Download
memory/1064-0-0x0000000000400000-0x0000000000569000-memory.dmp

Filesize
1.4MB

Download
memory/1064-8-0x0000000000610000-0x0000000000611000-memory.dmp

Filesize
4KB

Download
memory/1064-10-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/1064-12-0x00000000032C0000-0x00000000032C1000-memory.dmp

Filesize
4KB

Download
memory/1064-7-0x00000000008B0000-0x00000000008B1000-memory.dmp

Filesize
4KB

Download
memory/1064-6-0x0000000000570000-0x0000000000571000-memory.dmp

Filesize
4KB

Download
memory/1064-5-0x0000000000580000-0x0000000000581000-memory.dmp

Filesize
4KB

Download
memory/1064-4-0x00000000008C0000-0x00000000008C1000-memory.dmp

Filesize
4KB

Download
memory/1064-3-0x00000000005A0000-0x00000000005A1000-memory.dmp

Filesize
4KB

Download
memory/1064-2-0x0000000000600000-0x0000000000601000-memory.dmp

Filesize
4KB

Download
memory/1064-9-0x00000000008D0000-0x00000000008D1000-memory.dmp

Filesize
4KB

Download
memory/1064-1-0x0000000000390000-0x00000000003E4000-memory.dmp

Filesize
336KB

Download
memory/1064-38-0x0000000000390000-0x00000000003E4000-memory.dmp

Filesize
336KB

Download
memory/1064-37-0x0000000000400000-0x0000000000569000-memory.dmp

Filesize
1.4MB

Download
memory/2724-40-0x0000000000400000-0x0000000000569000-memory.dmp

Filesize
1.4MB

Download
memory/2724-45-0x0000000000400000-0x0000000000569000-memory.dmp

Filesize
1.4MB

Download