Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
04-04-2024 14:28
Static task
static1
Behavioral task
behavioral1
Sample
babccaf657298d70471771c106155a7d_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
babccaf657298d70471771c106155a7d_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
babccaf657298d70471771c106155a7d_JaffaCakes118.exe
-
Size
428KB
-
MD5
babccaf657298d70471771c106155a7d
-
SHA1
6601807cf5c92f22768d241baaa28c6dc78dc30f
-
SHA256
74e7f6690f05ee4303f5de3880170df6306736508c2227c4aa319c799051b428
-
SHA512
b266fec3df678ceeadc6cd604ef4594b31a81ea5a62ea571732948d2f931c59480eae4a169ec912571e41e113d69ab61df4d6392e490742973315608c7abe8e0
-
SSDEEP
6144:7CE6/mUXJ531nIUliViSZbLhaZfvMlLXICg2vj7Oyz:l6TOUMBQf0ljW2vj7Oyz
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4636 2172 WerFault.exe winver.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
winver.exepid process 2172 winver.exe 2172 winver.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Explorer.EXEdescription pid process Token: SeShutdownPrivilege 3496 Explorer.EXE Token: SeCreatePagefilePrivilege 3496 Explorer.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
winver.exepid process 2172 winver.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3496 Explorer.EXE -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
babccaf657298d70471771c106155a7d_JaffaCakes118.exewinver.exedescription pid process target process PID 3044 wrote to memory of 2172 3044 babccaf657298d70471771c106155a7d_JaffaCakes118.exe winver.exe PID 3044 wrote to memory of 2172 3044 babccaf657298d70471771c106155a7d_JaffaCakes118.exe winver.exe PID 3044 wrote to memory of 2172 3044 babccaf657298d70471771c106155a7d_JaffaCakes118.exe winver.exe PID 3044 wrote to memory of 2172 3044 babccaf657298d70471771c106155a7d_JaffaCakes118.exe winver.exe PID 2172 wrote to memory of 3496 2172 winver.exe Explorer.EXE PID 2172 wrote to memory of 3064 2172 winver.exe sihost.exe
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:3064
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\babccaf657298d70471771c106155a7d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\babccaf657298d70471771c106155a7d_JaffaCakes118.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\SysWOW64\winver.exewinver3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 5804⤵
- Program crash
PID:4636
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2172 -ip 21721⤵PID:2692