Analysis
-
max time kernel
93s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
06-04-2024 08:17
Behavioral task
behavioral1
Sample
dfd9612cb55b1cfc4a33d9fdaf8ed070_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
dfd9612cb55b1cfc4a33d9fdaf8ed070_JaffaCakes118.exe
Resource
win10v2004-20231215-en
General
-
Target
dfd9612cb55b1cfc4a33d9fdaf8ed070_JaffaCakes118.exe
-
Size
30KB
-
MD5
dfd9612cb55b1cfc4a33d9fdaf8ed070
-
SHA1
5da6d9f8e4962eb7ea17e869ee5b586101b002c3
-
SHA256
ec1a5fbd6a5ca09382dd4b71f473657eba1a4a6e0982bcd01697821ca24d84f9
-
SHA512
d8173f7931f90d4748bd0fcafe42cf9c447557eefde5ab5fbd93d5ec276d1f357f284131d00848ee004b8417b365eb0c6b08e5c48e4fa400a75bc249b4f64160
-
SSDEEP
768:ERamfeaO55OIzv6ZrHwPZB65U7Y+7vZc5tunV7KYhJ:Lmi5OI76RHwPb61ov/nV7KmJ
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz dw20.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dw20.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeRestorePrivilege 4672 dw20.exe Token: SeBackupPrivilege 4672 dw20.exe Token: SeBackupPrivilege 4672 dw20.exe Token: SeBackupPrivilege 4672 dw20.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4404 wrote to memory of 4672 4404 dfd9612cb55b1cfc4a33d9fdaf8ed070_JaffaCakes118.exe 84 PID 4404 wrote to memory of 4672 4404 dfd9612cb55b1cfc4a33d9fdaf8ed070_JaffaCakes118.exe 84 PID 4404 wrote to memory of 4672 4404 dfd9612cb55b1cfc4a33d9fdaf8ed070_JaffaCakes118.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\dfd9612cb55b1cfc4a33d9fdaf8ed070_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\dfd9612cb55b1cfc4a33d9fdaf8ed070_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8402⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:4672
-