Analysis
-
max time kernel
149s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21-04-2024 05:50
Behavioral task
behavioral1
Sample
fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
9 signatures
150 seconds
General
-
Target
fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe
-
Size
235KB
-
MD5
fe9519d271fe522e08d088a98a50ebb3
-
SHA1
4fc1d9471c35346791f1c7dd079961c979ff41f6
-
SHA256
6a84fe3e7eca6838dea1491c61bcf281f921ac7c924e3bef6f93a0f4ee77af48
-
SHA512
61ec0b5b53e67b4ab42cee8b1f0b277f651f81df3c5a76db9dfd94fab3e5957e217ccb58ae217e3271defef14ac8674c7bbb58f463e0375162a5fb580cd54a57
-
SSDEEP
6144:b4CFfifD2gVKVTQQ249HZ52KTh9XKOCgLJacj5/AZtRs5q:bXgr8VMQDT52WXKq9fj5/AZj4q
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
explorer.exefe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exedescription ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe -
Processes:
resource yara_rule behavioral1/memory/860-0-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2208-6-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/860-8-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2208-7-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2208-9-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2208-11-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2208-12-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2208-14-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2208-15-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2208-16-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2208-17-0x0000000000400000-0x00000000004B5000-memory.dmp upx -
Suspicious use of SetThreadContext 1 IoCs
Processes:
fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exedescription pid Process procid_target PID 860 set thread context of 2208 860 fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe 28 -
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exeexplorer.exedescription ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier explorer.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exeexplorer.exedescription ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier explorer.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exeexplorer.exedescription pid Process Token: SeIncreaseQuotaPrivilege 860 fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe Token: SeSecurityPrivilege 860 fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 860 fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe Token: SeLoadDriverPrivilege 860 fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe Token: SeSystemProfilePrivilege 860 fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe Token: SeSystemtimePrivilege 860 fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 860 fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 860 fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 860 fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe Token: SeBackupPrivilege 860 fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe Token: SeRestorePrivilege 860 fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe Token: SeShutdownPrivilege 860 fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe Token: SeDebugPrivilege 860 fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 860 fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 860 fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 860 fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe Token: SeUndockPrivilege 860 fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe Token: SeManageVolumePrivilege 860 fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe Token: SeImpersonatePrivilege 860 fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 860 fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe Token: 33 860 fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe Token: 34 860 fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe Token: 35 860 fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 2208 explorer.exe Token: SeSecurityPrivilege 2208 explorer.exe Token: SeTakeOwnershipPrivilege 2208 explorer.exe Token: SeLoadDriverPrivilege 2208 explorer.exe Token: SeSystemProfilePrivilege 2208 explorer.exe Token: SeSystemtimePrivilege 2208 explorer.exe Token: SeProfSingleProcessPrivilege 2208 explorer.exe Token: SeIncBasePriorityPrivilege 2208 explorer.exe Token: SeCreatePagefilePrivilege 2208 explorer.exe Token: SeBackupPrivilege 2208 explorer.exe Token: SeRestorePrivilege 2208 explorer.exe Token: SeShutdownPrivilege 2208 explorer.exe Token: SeDebugPrivilege 2208 explorer.exe Token: SeSystemEnvironmentPrivilege 2208 explorer.exe Token: SeChangeNotifyPrivilege 2208 explorer.exe Token: SeRemoteShutdownPrivilege 2208 explorer.exe Token: SeUndockPrivilege 2208 explorer.exe Token: SeManageVolumePrivilege 2208 explorer.exe Token: SeImpersonatePrivilege 2208 explorer.exe Token: SeCreateGlobalPrivilege 2208 explorer.exe Token: 33 2208 explorer.exe Token: 34 2208 explorer.exe Token: 35 2208 explorer.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
explorer.exepid Process 2208 explorer.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exedescription pid Process procid_target PID 860 wrote to memory of 2208 860 fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe 28 PID 860 wrote to memory of 2208 860 fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe 28 PID 860 wrote to memory of 2208 860 fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe 28 PID 860 wrote to memory of 2208 860 fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe 28 PID 860 wrote to memory of 2208 860 fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe 28 PID 860 wrote to memory of 2208 860 fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe"1⤵
- Checks BIOS information in registry
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Checks BIOS information in registry
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2208
-