Analysis
- max time kernel
114s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
02/04/2024, 00:03
Static task
static1
Behavioral task
behavioral1
Sample
7dfe8ea08607a581f8e266566ddf3b0e_JaffaCakes118.ps1
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
7dfe8ea08607a581f8e266566ddf3b0e_JaffaCakes118.ps1
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target 7dfe8ea08607a581f8e266566ddf3b0e_JaffaCakes118.ps1
- Size 528KB
- Sample240402-acazlabc55
- SHA256 7e6661179d2df5f0923ce3952e3efd79af3acf0d7f085ca327f1d3485d1b141f
- MD5 7dfe8ea08607a581f8e266566ddf3b0e
- SHA1 904a4f07384d89f0485753dfe42457524a6c5159
- SHA512 7c60361520a8a0dc1a36f9f85a480c87a32ac2574fdb655dfefb386790ca906a5e551a5e6d774cbe93d11a1687512fc47e436f983410fa6e1389a4616fce5642
- SSDEEP 12288:BzmmI07e28nbgpURsOf+V7tvWUhE34CYsqX0KXoD9niTvr:xXrQgpik7tvVeIfroD9e
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
- mimikatz is an open source tool to dump credentials on Windows 2 IoCs
resource yara_rule behavioral2/memory/5100-31-0x000001DFA94D0000-0x000001DFA955A000-memory.dmp mimikatz behavioral2/memory/5100-47-0x000001DFA94D0000-0x000001DFA955A000-memory.dmp mimikatz - Deletes itself 1 IoCs
pid Process 5100 powershell.exe - Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\system32\out.txt powershell.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 5100 powershell.exe 5100 powershell.exe 5100 powershell.exe 5100 powershell.exe 5100 powershell.exe 5100 powershell.exe 5100 powershell.exe 5100 powershell.exe 5100 powershell.exe 5100 powershell.exe - Suspicious behavior: RenamesItself 1 IoCs
pid Process 5100 powershell.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 5100 powershell.exe Token: SeDebugPrivilege 5100 powershell.exe - Suspicious use of WriteProcessMemory 54 IoCs
description pid Process procid_target PID 5100 wrote to memory of 4788 5100 powershell.exe 95 PID 5100 wrote to memory of 4788 5100 powershell.exe 95 PID 4788 wrote to memory of 5052 4788 csc.exe 97 PID 4788 wrote to memory of 5052 4788 csc.exe 97 PID 5100 wrote to memory of 664 5100 powershell.exe 7 PID 5100 wrote to memory of 664 5100 powershell.exe 7 PID 5100 wrote to memory of 664 5100 powershell.exe 7 PID 5100 wrote to memory of 664 5100 powershell.exe 7 PID 5100 wrote to memory of 664 5100 powershell.exe 7 PID 5100 wrote to memory of 664 5100 powershell.exe 7 PID 664 wrote to memory of 2804 664 lsass.exe 49 PID 664 wrote to memory of 2804 664 lsass.exe 49 PID 664 wrote to memory of 3560 664 lsass.exe 98 PID 664 wrote to memory of 3560 664 lsass.exe 98 PID 664 wrote to memory of 3560 664 lsass.exe 98 PID 664 wrote to memory of 3560 664 lsass.exe 98 PID 664 wrote to memory of 3560 664 lsass.exe 98 PID 664 wrote to memory of 3560 664 lsass.exe 98 PID 664 wrote to memory of 3560 664 lsass.exe 98 PID 664 wrote to memory of 3560 664 lsass.exe 98 PID 664 wrote to memory of 3560 664 lsass.exe 98 PID 664 wrote to memory of 3560 664 lsass.exe 98 PID 664 wrote to memory of 3560 664 lsass.exe 98 PID 664 wrote to memory of 2804 664 lsass.exe 49 PID 664 wrote to memory of 2804 664 lsass.exe 49 PID 664 wrote to memory of 3288 664 lsass.exe 101 PID 664 wrote to memory of 3288 664 lsass.exe 101 PID 664 wrote to memory of 3288 664 lsass.exe 101 PID 664 wrote to memory of 3288 664 lsass.exe 101 PID 664 wrote to memory of 3288 664 lsass.exe 101 PID 664 wrote to memory of 3288 664 lsass.exe 101 PID 664 wrote to memory of 3288 664 lsass.exe 101 PID 664 wrote to memory of 3288 664 lsass.exe 101 PID 664 wrote to memory of 3288 664 lsass.exe 101 PID 664 wrote to memory of 3288 664 lsass.exe 101 PID 664 wrote to memory of 3288 664 lsass.exe 101 PID 664 wrote to memory of 3288 664 lsass.exe 101 PID 664 wrote to memory of 2188 664 lsass.exe 40 PID 664 wrote to memory of 2804 664 lsass.exe 49 PID 664 wrote to memory of 2804 664 lsass.exe 49 PID 664 wrote to memory of 2804 664 lsass.exe 49 PID 664 wrote to memory of 3012 664 lsass.exe 104 PID 664 wrote to memory of 3012 664 lsass.exe 104 PID 664 wrote to memory of 3012 664 lsass.exe 104 PID 664 wrote to memory of 3012 664 lsass.exe 104 PID 664 wrote to memory of 3012 664 lsass.exe 104 PID 664 wrote to memory of 3012 664 lsass.exe 104 PID 664 wrote to memory of 3012 664 lsass.exe 104 PID 664 wrote to memory of 3012 664 lsass.exe 104 PID 664 wrote to memory of 3012 664 lsass.exe 104 PID 664 wrote to memory of 3012 664 lsass.exe 104 PID 664 wrote to memory of 3012 664 lsass.exe 104 PID 664 wrote to memory of 2804 664 lsass.exe 49 PID 664 wrote to memory of 2804 664 lsass.exe 49
Processes
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
- Suspicious use of WriteProcessMemory
PID:664
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵PID:2188
-
C:\Windows\sysmon.exeC:\Windows\sysmon.exe1⤵PID:2804
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\7dfe8ea08607a581f8e266566ddf3b0e_JaffaCakes118.ps11⤵
- Deletes itself
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wbuqpnvo\wbuqpnvo.cmdline"2⤵
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES81C3.tmp" "c:\Users\Admin\AppData\Local\Temp\wbuqpnvo\CSCDE953ACD78F14CECBB1F3F35994E185.TMP"3⤵PID:5052
-
-
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 3a1b9b6637582dc2b7d2741a40680668 yCXfNEFhSEy4nocXTA4Bmg.0.1.0.0.01⤵PID:3560
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵PID:3288
-
C:\Windows\System32\mousocoreworker.exeC:\Windows\System32\mousocoreworker.exe -Embedding1⤵PID:3012
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3884 --field-trial-handle=2272,i,17338911640954948469,1637568328132129119,262144 --variations-seed-version /prefetch:81⤵PID:5048
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\RES81C3.tmp
- Size 1KB
- SHA256 e4b5219727f95c42393b0af1a8adeb3dd4301208af9cf03942762596ecc8b108
- MD5 f94385f97f48078f34d95d1035f6578a
- SHA1 723c7afdf8bb855a98aec092dcac7af96ac0ae79
- SHA512 a394a08f0c7e4861a97d57b84bc992655b9d0f69da27ba2bd0c38855927355f335a31c34108febb54773a523cfb46545319b4dadb5fec5c2bcebba1a6f1ff985
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_k3srq32i.tzb.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\wbuqpnvo\wbuqpnvo.dll
- Size 3KB
- SHA256 f7b20e904a97b8ef7821ffc9df4d2ab0e623b6b8d8c54f20b841a4325f71f64f
- MD5 2c3a5b18b51e87afd6875568fb4af3d2
- SHA1 c253b86a627d3a11321b8eab6ec7fa5956fab235
- SHA512 9aa442be2a6f558b0be433ba2d8fde82e590541c12f397415f8711cb97506130ac4b566d0b5b94735c5266846464537b7306fbb99cb67e2c07bd50381d9aeaab
- MD5 SHA1 SHA512
- Path \??\c:\Users\Admin\AppData\Local\Temp\wbuqpnvo\CSCDE953ACD78F14CECBB1F3F35994E185.TMP
- Size 652B
- SHA256 5e8f6f66fd6a75f74e6458640e88116133a72ca657d5c5e7f95e9e8cfbc396e8
- MD5 cde9019fa3abe7b9b10ceda56ca5e05f
- SHA1 ace1c5d5d67c6d369bfefb1ed968546dd945bca8
- SHA512 37b1bd5e03087f2cf892c38f8b0bc9607aecde45c85ddf2295d8f1fc8e56044e768140a27db54cc25a153865918ac9d5da62a1ab31f18917fdb38fc7ee125b8b
- MD5 SHA1 SHA512
- Path \??\c:\Users\Admin\AppData\Local\Temp\wbuqpnvo\wbuqpnvo.0.cs
- Size 696B
- SHA256 8d8e8264841524b1bb7ec198e507f5734be6336b5923f5272ff541398181e0e5
- MD5 8bd48f1f4b7e06dd4837aed50d403ed3
- SHA1 252d67ecd93d07151985ef286afef9abb1226b5d
- SHA512 69f8b7d40540bacbfc93dfe36f4bb37366fa63d9c7fd054539dd61c24f4603757f229357961d72b497e11594f6116a9e8ae53bc4bcfbd295462354ef86ddd250
- MD5 SHA1 SHA512
- Path \??\c:\Users\Admin\AppData\Local\Temp\wbuqpnvo\wbuqpnvo.cmdline
- Size 369B
- SHA256 91f9472c2a42fc7f7a17d902a9cf6b2c388837529909433e952aa6c2cbd41fbf
- MD5 3faa38f3424aa3c764637bb3ca831189
- SHA1 8dabd7ecca45d37cdf1856d9a3848b68b3c1fcc6
- SHA512 89fb2ccc64baee10e4df64e6f3a9f1ef22eb4f964e14978cf362084f67e16982bc831a74ad7a8d48d74496232c1301762923ffeb9a4347347d6861868039c909
- MD5 SHA1 SHA512