Analysis
-
max time kernel
148s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
21-04-2024 05:50
Behavioral task
behavioral1
Sample
fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
9 signatures
150 seconds
General
-
Target
fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe
-
Size
235KB
-
MD5
fe9519d271fe522e08d088a98a50ebb3
-
SHA1
4fc1d9471c35346791f1c7dd079961c979ff41f6
-
SHA256
6a84fe3e7eca6838dea1491c61bcf281f921ac7c924e3bef6f93a0f4ee77af48
-
SHA512
61ec0b5b53e67b4ab42cee8b1f0b277f651f81df3c5a76db9dfd94fab3e5957e217ccb58ae217e3271defef14ac8674c7bbb58f463e0375162a5fb580cd54a57
-
SSDEEP
6144:b4CFfifD2gVKVTQQ249HZ52KTh9XKOCgLJacj5/AZtRs5q:bXgr8VMQDT52WXKq9fj5/AZj4q
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exeexplorer.exedescription ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate explorer.exe -
Processes:
resource yara_rule behavioral2/memory/4268-0-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/2656-2-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/2656-3-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4268-5-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/2656-4-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/2656-6-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/2656-7-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/2656-9-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/2656-10-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/2656-11-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/2656-12-0x0000000000400000-0x00000000004B5000-memory.dmp upx -
Suspicious use of SetThreadContext 1 IoCs
Processes:
fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exedescription pid Process procid_target PID 4268 set thread context of 2656 4268 fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe 85 -
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exeexplorer.exedescription ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier explorer.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exeexplorer.exedescription ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier explorer.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
Processes:
fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exeexplorer.exedescription pid Process Token: SeIncreaseQuotaPrivilege 4268 fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe Token: SeSecurityPrivilege 4268 fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 4268 fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe Token: SeLoadDriverPrivilege 4268 fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe Token: SeSystemProfilePrivilege 4268 fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe Token: SeSystemtimePrivilege 4268 fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 4268 fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4268 fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 4268 fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe Token: SeBackupPrivilege 4268 fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe Token: SeRestorePrivilege 4268 fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe Token: SeShutdownPrivilege 4268 fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe Token: SeDebugPrivilege 4268 fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 4268 fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 4268 fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 4268 fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe Token: SeUndockPrivilege 4268 fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe Token: SeManageVolumePrivilege 4268 fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe Token: SeImpersonatePrivilege 4268 fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 4268 fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe Token: 33 4268 fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe Token: 34 4268 fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe Token: 35 4268 fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe Token: 36 4268 fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 2656 explorer.exe Token: SeSecurityPrivilege 2656 explorer.exe Token: SeTakeOwnershipPrivilege 2656 explorer.exe Token: SeLoadDriverPrivilege 2656 explorer.exe Token: SeSystemProfilePrivilege 2656 explorer.exe Token: SeSystemtimePrivilege 2656 explorer.exe Token: SeProfSingleProcessPrivilege 2656 explorer.exe Token: SeIncBasePriorityPrivilege 2656 explorer.exe Token: SeCreatePagefilePrivilege 2656 explorer.exe Token: SeBackupPrivilege 2656 explorer.exe Token: SeRestorePrivilege 2656 explorer.exe Token: SeShutdownPrivilege 2656 explorer.exe Token: SeDebugPrivilege 2656 explorer.exe Token: SeSystemEnvironmentPrivilege 2656 explorer.exe Token: SeChangeNotifyPrivilege 2656 explorer.exe Token: SeRemoteShutdownPrivilege 2656 explorer.exe Token: SeUndockPrivilege 2656 explorer.exe Token: SeManageVolumePrivilege 2656 explorer.exe Token: SeImpersonatePrivilege 2656 explorer.exe Token: SeCreateGlobalPrivilege 2656 explorer.exe Token: 33 2656 explorer.exe Token: 34 2656 explorer.exe Token: 35 2656 explorer.exe Token: 36 2656 explorer.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
explorer.exepid Process 2656 explorer.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exedescription pid Process procid_target PID 4268 wrote to memory of 2656 4268 fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe 85 PID 4268 wrote to memory of 2656 4268 fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe 85 PID 4268 wrote to memory of 2656 4268 fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe 85 PID 4268 wrote to memory of 2656 4268 fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe 85 PID 4268 wrote to memory of 2656 4268 fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fe9519d271fe522e08d088a98a50ebb3_JaffaCakes118.exe"1⤵
- Checks BIOS information in registry
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Checks BIOS information in registry
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2656
-