Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
26/04/2024, 12:24
Static task
static1
Behavioral task
behavioral1
Sample
00c3d36c26afe8dd6ad99a32e0a265d6_JaffaCakes118.exe
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral2
Sample
00c3d36c26afe8dd6ad99a32e0a265d6_JaffaCakes118.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/nsisunz.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/nsisunz.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/rzvqilk.dll
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/rzvqilk.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
General
-
Target
00c3d36c26afe8dd6ad99a32e0a265d6_JaffaCakes118.exe
-
Size
677KB
-
MD5
00c3d36c26afe8dd6ad99a32e0a265d6
-
SHA1
ee858741e7b8c4f8106f7ff79a916dba55b64b74
-
SHA256
1406b23d2ea5302faf5cbfe4bd3591ba86caac11e0c74516a8dbd20ef21d719d
-
SHA512
3c330bb119a090c45c21e9479e57ddcda92ed4db5d06e039e4d26fce967b06ad506a683b2308446b61458075a5ab847d8ba72e41e34f5755b4fbb1c812e9d0e6
-
SSDEEP
12288:WYUrfzVQkQRKI8KnAg3aMcJheKBmZDZIJ0c/zlRrGuOQuNpOGpjeN/x:Wjrf5pE84aMbK30erSy5
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2272 1431993751.exe -
Loads dropped DLL 11 IoCs
pid Process 1268 00c3d36c26afe8dd6ad99a32e0a265d6_JaffaCakes118.exe 1268 00c3d36c26afe8dd6ad99a32e0a265d6_JaffaCakes118.exe 1268 00c3d36c26afe8dd6ad99a32e0a265d6_JaffaCakes118.exe 1268 00c3d36c26afe8dd6ad99a32e0a265d6_JaffaCakes118.exe 2320 WerFault.exe 2320 WerFault.exe 2320 WerFault.exe 2320 WerFault.exe 2320 WerFault.exe 2320 WerFault.exe 2320 WerFault.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 2320 2272 WerFault.exe 28 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2544 wmic.exe Token: SeSecurityPrivilege 2544 wmic.exe Token: SeTakeOwnershipPrivilege 2544 wmic.exe Token: SeLoadDriverPrivilege 2544 wmic.exe Token: SeSystemProfilePrivilege 2544 wmic.exe Token: SeSystemtimePrivilege 2544 wmic.exe Token: SeProfSingleProcessPrivilege 2544 wmic.exe Token: SeIncBasePriorityPrivilege 2544 wmic.exe Token: SeCreatePagefilePrivilege 2544 wmic.exe Token: SeBackupPrivilege 2544 wmic.exe Token: SeRestorePrivilege 2544 wmic.exe Token: SeShutdownPrivilege 2544 wmic.exe Token: SeDebugPrivilege 2544 wmic.exe Token: SeSystemEnvironmentPrivilege 2544 wmic.exe Token: SeRemoteShutdownPrivilege 2544 wmic.exe Token: SeUndockPrivilege 2544 wmic.exe Token: SeManageVolumePrivilege 2544 wmic.exe Token: 33 2544 wmic.exe Token: 34 2544 wmic.exe Token: 35 2544 wmic.exe Token: SeIncreaseQuotaPrivilege 2544 wmic.exe Token: SeSecurityPrivilege 2544 wmic.exe Token: SeTakeOwnershipPrivilege 2544 wmic.exe Token: SeLoadDriverPrivilege 2544 wmic.exe Token: SeSystemProfilePrivilege 2544 wmic.exe Token: SeSystemtimePrivilege 2544 wmic.exe Token: SeProfSingleProcessPrivilege 2544 wmic.exe Token: SeIncBasePriorityPrivilege 2544 wmic.exe Token: SeCreatePagefilePrivilege 2544 wmic.exe Token: SeBackupPrivilege 2544 wmic.exe Token: SeRestorePrivilege 2544 wmic.exe Token: SeShutdownPrivilege 2544 wmic.exe Token: SeDebugPrivilege 2544 wmic.exe Token: SeSystemEnvironmentPrivilege 2544 wmic.exe Token: SeRemoteShutdownPrivilege 2544 wmic.exe Token: SeUndockPrivilege 2544 wmic.exe Token: SeManageVolumePrivilege 2544 wmic.exe Token: 33 2544 wmic.exe Token: 34 2544 wmic.exe Token: 35 2544 wmic.exe Token: SeIncreaseQuotaPrivilege 2676 wmic.exe Token: SeSecurityPrivilege 2676 wmic.exe Token: SeTakeOwnershipPrivilege 2676 wmic.exe Token: SeLoadDriverPrivilege 2676 wmic.exe Token: SeSystemProfilePrivilege 2676 wmic.exe Token: SeSystemtimePrivilege 2676 wmic.exe Token: SeProfSingleProcessPrivilege 2676 wmic.exe Token: SeIncBasePriorityPrivilege 2676 wmic.exe Token: SeCreatePagefilePrivilege 2676 wmic.exe Token: SeBackupPrivilege 2676 wmic.exe Token: SeRestorePrivilege 2676 wmic.exe Token: SeShutdownPrivilege 2676 wmic.exe Token: SeDebugPrivilege 2676 wmic.exe Token: SeSystemEnvironmentPrivilege 2676 wmic.exe Token: SeRemoteShutdownPrivilege 2676 wmic.exe Token: SeUndockPrivilege 2676 wmic.exe Token: SeManageVolumePrivilege 2676 wmic.exe Token: 33 2676 wmic.exe Token: 34 2676 wmic.exe Token: 35 2676 wmic.exe Token: SeIncreaseQuotaPrivilege 2652 wmic.exe Token: SeSecurityPrivilege 2652 wmic.exe Token: SeTakeOwnershipPrivilege 2652 wmic.exe Token: SeLoadDriverPrivilege 2652 wmic.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 1268 wrote to memory of 2272 1268 00c3d36c26afe8dd6ad99a32e0a265d6_JaffaCakes118.exe 28 PID 1268 wrote to memory of 2272 1268 00c3d36c26afe8dd6ad99a32e0a265d6_JaffaCakes118.exe 28 PID 1268 wrote to memory of 2272 1268 00c3d36c26afe8dd6ad99a32e0a265d6_JaffaCakes118.exe 28 PID 1268 wrote to memory of 2272 1268 00c3d36c26afe8dd6ad99a32e0a265d6_JaffaCakes118.exe 28 PID 2272 wrote to memory of 2544 2272 1431993751.exe 29 PID 2272 wrote to memory of 2544 2272 1431993751.exe 29 PID 2272 wrote to memory of 2544 2272 1431993751.exe 29 PID 2272 wrote to memory of 2544 2272 1431993751.exe 29 PID 2272 wrote to memory of 2676 2272 1431993751.exe 32 PID 2272 wrote to memory of 2676 2272 1431993751.exe 32 PID 2272 wrote to memory of 2676 2272 1431993751.exe 32 PID 2272 wrote to memory of 2676 2272 1431993751.exe 32 PID 2272 wrote to memory of 2652 2272 1431993751.exe 34 PID 2272 wrote to memory of 2652 2272 1431993751.exe 34 PID 2272 wrote to memory of 2652 2272 1431993751.exe 34 PID 2272 wrote to memory of 2652 2272 1431993751.exe 34 PID 2272 wrote to memory of 2424 2272 1431993751.exe 36 PID 2272 wrote to memory of 2424 2272 1431993751.exe 36 PID 2272 wrote to memory of 2424 2272 1431993751.exe 36 PID 2272 wrote to memory of 2424 2272 1431993751.exe 36 PID 2272 wrote to memory of 1740 2272 1431993751.exe 38 PID 2272 wrote to memory of 1740 2272 1431993751.exe 38 PID 2272 wrote to memory of 1740 2272 1431993751.exe 38 PID 2272 wrote to memory of 1740 2272 1431993751.exe 38 PID 2272 wrote to memory of 2320 2272 1431993751.exe 40 PID 2272 wrote to memory of 2320 2272 1431993751.exe 40 PID 2272 wrote to memory of 2320 2272 1431993751.exe 40 PID 2272 wrote to memory of 2320 2272 1431993751.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\00c3d36c26afe8dd6ad99a32e0a265d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\00c3d36c26afe8dd6ad99a32e0a265d6_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\1431993751.exeC:\Users\Admin\AppData\Local\Temp\1431993751.exe 6#2#5#4#5#2#0#8#8#7#2 KU5EQDgxMCoqGS1NUz1MREI9KBgoTD9SUktNSUk8NSkeKUJET09HRDUqMDAxMhsrPkdENSgZLUpQSkBQQVRXQT07KzQ0MBstUz1KT0NMXVBORztobGxpOCktbm5xLEQ9S0QrTk1LKTxOUCZBR0RJHio/R0dDQ0E9O3FIUE5KNEg9TE5RR0NBSEUuVT46TUkwRxsrPy89KSgpNhotPy44KzEYJz0xNyssHCpCNDUlKh4pQjA5KC8gJ0hLTT5TPlBaTlJBTjpBUzsbK0tQTzxNPFJZQ1BIPDsgJ0hLTT5TPlBaTEFFPTYeKUNTQVpTUkQ1GS0/VkBbPktEREFHQzceKkRKUVRXOktNUVFATjgvICdMQT9ISVRLUF1VSkQ2HilUSDktHi88Syo7Gi1NUUlSSUU9WFU/Sj5LSENJRTlAQ09QRzkbLUlLV0tTSFJESUA7dGptXh4pUEBQUFBOQUZAXU9RQE5aQkFRSzYwGi1DRT9DWDUpGS1DUVpAVExBRUE8XT9MPk5UTlQ9PDZkW2puYRstREdPR0pJPz9bRE49KS8xLCsyKyotMTQmLC4eKVJESUA7MSwrKy4qMi4sLB4vPEdQTEZNPEBaUklFPTYzKS80Ky0uMS0iKzgvNjUuLChBRRgoUzs7SGt1Z2xkWR4wYDMpLCYmV2FmXW1xcSZKTyk2JikeMVwpbXIgMWEqLScuIylCYV5pbx0qXzAqLyssLC4xIz5icF9kanQgMGYqLScuGi1QTkc7aGxsaSMtXyAuYSMyXl9ecissKy0sL2Rda2JlaCxkamFtJSpeS3NoUmRpYEJvb2ZlbVtiSF1pX2ddalhiX25na3QjMl4pLTEsLiswLi40HSpfYml1aWhqX2RlWWdfYWNtIS1kMSwrKy4qMi4sLyMzXi0qNisuMDM0NjUuUWZQbVJlX3FNR1spRWdpckhOMGhQSyhwSU02cUVCYThDTE4zRnY0aElRc19Qcz8rSz89bUtSKVtFUl1tSD4waE1yX2ZJPDNhSGVlc0NLT2lHQlRnRlFGX1JAcl5gUkJqVmpKalJFL3VddDBnYj9KXFdnRGFKLkhKTE4/TkdTQDRPREJGSz5PHzBdTyttckxiKTROLlB0TkA1Z1ErbmhMPms=2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81714134246.txt bios get serialnumber3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2544
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81714134246.txt bios get version3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2676
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81714134246.txt bios get version3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2652
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81714134246.txt bios get version3⤵PID:2424
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81714134246.txt bios get version3⤵PID:1740
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 3683⤵
- Loads dropped DLL
- Program crash
PID:2320
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
66B
MD59025468f85256136f923096b01375964
SHA17fcd174999661594fa5f88890ffb195e9858cc52
SHA256d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df
SHA51292cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51
-
Filesize
1021KB
MD53e442360dd7b1e18ebff02ee6826d593
SHA18ebc97f7360c7f9fb6cb2cb33fb298fd8e7ee502
SHA2566146c354b5226ab474d5ad191be2f685fc6e3623eeb2c9f96c1ea7767c434081
SHA5124f7dccd78a88495a2588c058acc715277c9812b4fbdff9aff9906bb2b3109c857acb9c277cb342a5fff700da8d39b2760d08445397b7481378ebd667671edde0
-
Filesize
40KB
MD55f13dbc378792f23e598079fc1e4422b
SHA15813c05802f15930aa860b8363af2b58426c8adf
SHA2566e87ecb7f62039fbb6e7676422d1a5e75a32b90dde6865dcb68ee658ba8df61d
SHA5129270635a5294482f49e0292e26d45dd103b85fe27dc163d44531b095c5f9dbde6b904adaf1a888ba3c112a094380394713c796f5195b2566a20f00b42b6578e5
-
Filesize
158KB
MD5b7de66fb6de771bd04f51454ce1232c3
SHA18773323ffd3bd32d0065dc3f92f6d076ad769b10
SHA25682377f5992f79b420e851a47a5cd0c4491d3346f9472615b3f4b7ccd5404397d
SHA512b005b5c471b796b2c964e9c7f8c3df7326f26a6310309f9b8cf29e6f0d379276360d59a6b333969c9a468dd47ddf8ef9a01a45fb8c6d2f0961d511d6013a9428