01b908cb399e5088eb9d2d6aa8afdf49139370750a092c73185df7fb8aafc676

Analysis

max time kernel
134s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
01/11/2024, 10:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8462d74fdbedcb32579b0e67dd1e07ef_JaffaCakes118.exe
Size 773KB
Sample241101-mx13qs1pdp
SHA256 01b908cb399e5088eb9d2d6aa8afdf49139370750a092c73185df7fb8aafc676
MD5 8462d74fdbedcb32579b0e67dd1e07ef
SHA1 c2ff063cfc81473b13852250012f5e1455df4e61
SHA512 779614400f0e3ef4b1883026542c0866d2f894e431b06b4671eb10498c5e27cb9980b0eb56aec5536004dddff97f3ad5a87b10d0e04f9c3c87bf004fa1d1ff4a
SSDEEP 12288:nKVor+xCwP+U4gcN2KA71uA46dNyKxElDrNk0mGDJPSyEy26g3oWGKegoBM/sPd2:mor+wwnZx71uxj8+NkG9PSywOKegx/V
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3844	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2872	usеrinit.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4348 set thread context of 3844	4348	8462d74fdbedcb32579b0e67dd1e07ef_JaffaCakes118.exe	87

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8462d74fdbedcb32579b0e67dd1e07ef_JaffaCakes118.exe

Modifies registry class 4 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{f456cbc2-bfc5-6f65-aca0-986e7eba0308}\u = "131083"	8462d74fdbedcb32579b0e67dd1e07ef_JaffaCakes118.exe
Key created	\registry\machine\Software\Classes\Interface\{f456cbc2-bfc5-6f65-aca0-986e7eba0308}	8462d74fdbedcb32579b0e67dd1e07ef_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{f456cbc2-bfc5-6f65-aca0-986e7eba0308}\u = "131083"	8462d74fdbedcb32579b0e67dd1e07ef_JaffaCakes118.exe
Key created	\registry\machine\Software\Classes\WOW6432Node\Interface\{f456cbc2-bfc5-6f65-aca0-986e7eba0308}	8462d74fdbedcb32579b0e67dd1e07ef_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2872	usеrinit.exe
2872	usеrinit.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4348	8462d74fdbedcb32579b0e67dd1e07ef_JaffaCakes118.exe
Token: SeSecurityPrivilege	4348	8462d74fdbedcb32579b0e67dd1e07ef_JaffaCakes118.exe
Token: SeDebugPrivilege	2872	usеrinit.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4348 wrote to memory of 3844	4348	8462d74fdbedcb32579b0e67dd1e07ef_JaffaCakes118.exe	87
PID 4348 wrote to memory of 3844	4348	8462d74fdbedcb32579b0e67dd1e07ef_JaffaCakes118.exe	87
PID 4348 wrote to memory of 3844	4348	8462d74fdbedcb32579b0e67dd1e07ef_JaffaCakes118.exe	87
PID 4348 wrote to memory of 3844	4348	8462d74fdbedcb32579b0e67dd1e07ef_JaffaCakes118.exe	87
PID 4348 wrote to memory of 2872	4348	8462d74fdbedcb32579b0e67dd1e07ef_JaffaCakes118.exe	89
PID 4348 wrote to memory of 2872	4348	8462d74fdbedcb32579b0e67dd1e07ef_JaffaCakes118.exe	89

C:\Users\Admin\AppData\Local\Temp\8462d74fdbedcb32579b0e67dd1e07ef_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8462d74fdbedcb32579b0e67dd1e07ef_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  - Deletes itself
  PID:3844
- \??\globalroot\systemroot\system32\usеrinit.exe
  /install
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

usеrinit.exe

Path \??\globalroot\systemroot\system32\usеrinit.exe
Size 139KB
SHA256 29b5b65a1cdf119ac7c6c9df76c6843b25a81bd00aa5a5e995ec675e34bf1acb
MD5 4acd14244d2cd76d06939163127cfb10
SHA1 75f3e3c764f7d20c9950f5410f753f3210bcc2e7
SHA512 001504da15c1825102479ba379b0be7ec15e779626d450d9d763552d7e1ac71f5bb86110f9361363bd401aabc53cdfd2d554480aec8bef85ed8c7b03cebf4031
SSDEEP 3072:b/3VPjhXdnXuWD3sQg4q0sA+j42SWX3rfxzpai:PXBnDIj42N1ai
MD5 SHA1 SHA512 SSDEEP

Submit Download

mseeeeee.dll

Path \systemroot\system32\mseeeeee.dll
Size 718KB
SHA256 7005bcf08950e7a3a58a31b6f7f413e9773afdb469e7c5c34d9995fd5d098ebd
MD5 9a46ad72fc1256eacce6462e6dc68192
SHA1 7dbd65c8354d0355b676d5800d6da6e717fc1c01
SHA512 1d0cf4ac4f7cb2c433a03fd31207f66449a834c42aeaf621c9c4fe05a7df57815ac878e93e76635235dfd1b9473519b8d8b536b54c92a256aa27ef77cd636ed0
SSDEEP 12288:kJ+q7OQd3AKUDf6i4ZPTdzoJWUFyw3ePyLY0V+AIrLa2XB1OMkfV7LupD/vWreNz:cv3AKvZPZcJhFJePyY0V+A6bR1OMkfVw
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4348-1-0x0000000000400000-0x0000000000496000-memory.dmp

Download

memory/4348-2-0x0000000000400000-0x00000000004C2E00-memory.dmp

Download

memory/4348-12-0x0000000000400000-0x0000000000496000-memory.dmp

Download

memory/4348-10-0x0000000000400000-0x00000000004C2E00-memory.dmp

Download