Analysis
-
max time kernel
147s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
18-04-2024 21:19
Behavioral task
behavioral1
Sample
f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe
Resource
win7-20240220-en
windows7-x64
9 signatures
150 seconds
General
-
Target
f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe
-
Size
875KB
-
MD5
f8c595b0ee2de1b5bcfe30ba5f78e25d
-
SHA1
77a0fdfe5c252cce12e66706514d0d56bb14b86f
-
SHA256
9ba41cd0356b6dcd14220e3d8cf7dc3ede3affb42aec2e8713cfbc850e540ace
-
SHA512
0087c96eb714dfb205833bfd51f86da329c9f3ad9d3d8a763042e60d3faecf01a95f4ce5eb1e696ec5473ef8b033b7868b70f73fcfdbdd1ed9beba7c70f6619c
-
SSDEEP
12288:r9AFlAd0Z+89cxTGzO4AucTD8QP2lmFSrVs9LqnK2P0JfLY1S8xul:5AQ6Zx9cxTmOrucTIEFSpOGn0J8k8x
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exeexplorer.exedescription ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate explorer.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exedescription pid Process procid_target PID 2828 set thread context of 5008 2828 f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe 86 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
explorer.exef8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exedescription ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier explorer.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 explorer.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
explorer.exef8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exedescription ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
Processes:
f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exeexplorer.exedescription pid Process Token: SeIncreaseQuotaPrivilege 2828 f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe Token: SeSecurityPrivilege 2828 f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2828 f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe Token: SeLoadDriverPrivilege 2828 f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe Token: SeSystemProfilePrivilege 2828 f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe Token: SeSystemtimePrivilege 2828 f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 2828 f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2828 f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 2828 f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe Token: SeBackupPrivilege 2828 f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe Token: SeRestorePrivilege 2828 f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe Token: SeShutdownPrivilege 2828 f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe Token: SeDebugPrivilege 2828 f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 2828 f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 2828 f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 2828 f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe Token: SeUndockPrivilege 2828 f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe Token: SeManageVolumePrivilege 2828 f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe Token: SeImpersonatePrivilege 2828 f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 2828 f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe Token: 33 2828 f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe Token: 34 2828 f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe Token: 35 2828 f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe Token: 36 2828 f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 5008 explorer.exe Token: SeSecurityPrivilege 5008 explorer.exe Token: SeTakeOwnershipPrivilege 5008 explorer.exe Token: SeLoadDriverPrivilege 5008 explorer.exe Token: SeSystemProfilePrivilege 5008 explorer.exe Token: SeSystemtimePrivilege 5008 explorer.exe Token: SeProfSingleProcessPrivilege 5008 explorer.exe Token: SeIncBasePriorityPrivilege 5008 explorer.exe Token: SeCreatePagefilePrivilege 5008 explorer.exe Token: SeBackupPrivilege 5008 explorer.exe Token: SeRestorePrivilege 5008 explorer.exe Token: SeShutdownPrivilege 5008 explorer.exe Token: SeDebugPrivilege 5008 explorer.exe Token: SeSystemEnvironmentPrivilege 5008 explorer.exe Token: SeChangeNotifyPrivilege 5008 explorer.exe Token: SeRemoteShutdownPrivilege 5008 explorer.exe Token: SeUndockPrivilege 5008 explorer.exe Token: SeManageVolumePrivilege 5008 explorer.exe Token: SeImpersonatePrivilege 5008 explorer.exe Token: SeCreateGlobalPrivilege 5008 explorer.exe Token: 33 5008 explorer.exe Token: 34 5008 explorer.exe Token: 35 5008 explorer.exe Token: 36 5008 explorer.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exedescription pid Process procid_target PID 2828 wrote to memory of 5008 2828 f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe 86 PID 2828 wrote to memory of 5008 2828 f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe 86 PID 2828 wrote to memory of 5008 2828 f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe 86 PID 2828 wrote to memory of 5008 2828 f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe 86 PID 2828 wrote to memory of 5008 2828 f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f8c595b0ee2de1b5bcfe30ba5f78e25d_JaffaCakes118.exe"1⤵
- Checks BIOS information in registry
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Checks BIOS information in registry
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:5008
-