Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
28/04/2024, 23:41
Static task
static1
Behavioral task
behavioral1
Sample
065495b2fb989af3b0adcbe7dbf05b89_JaffaCakes118.exe
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral2
Sample
065495b2fb989af3b0adcbe7dbf05b89_JaffaCakes118.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/adsfad.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/adsfad.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsisunz.dll
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsisunz.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
General
-
Target
065495b2fb989af3b0adcbe7dbf05b89_JaffaCakes118.exe
-
Size
575KB
-
MD5
065495b2fb989af3b0adcbe7dbf05b89
-
SHA1
4d46b9c24dfe9eccab8ca297cc1f31bb4ab6d005
-
SHA256
24c7afb01f6a84beab0668927a6f4c24f91736bbcb8b7e4cbf9076205e186017
-
SHA512
8bad09d88df34a16700c0db286fafb88ec2e5e4dd3d7e5a8a5c9c58a7724d616b741ebe7977e713afb8aa52487f9aeda6914816980790576d40331bbb8189356
-
SSDEEP
12288:vA2cZMMNaJ0+UEsnqY1taRfMBYl1hKJN0INZyIjpL5m2Lt:vAzca+URnRr6fMeDhKJN0InVpL5p
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2840 ecicabfbcafi.exe -
Loads dropped DLL 10 IoCs
pid Process 780 065495b2fb989af3b0adcbe7dbf05b89_JaffaCakes118.exe 780 065495b2fb989af3b0adcbe7dbf05b89_JaffaCakes118.exe 780 065495b2fb989af3b0adcbe7dbf05b89_JaffaCakes118.exe 3064 WerFault.exe 3064 WerFault.exe 3064 WerFault.exe 3064 WerFault.exe 3064 WerFault.exe 3064 WerFault.exe 3064 WerFault.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 3064 2840 WerFault.exe 28 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1608 wmic.exe Token: SeSecurityPrivilege 1608 wmic.exe Token: SeTakeOwnershipPrivilege 1608 wmic.exe Token: SeLoadDriverPrivilege 1608 wmic.exe Token: SeSystemProfilePrivilege 1608 wmic.exe Token: SeSystemtimePrivilege 1608 wmic.exe Token: SeProfSingleProcessPrivilege 1608 wmic.exe Token: SeIncBasePriorityPrivilege 1608 wmic.exe Token: SeCreatePagefilePrivilege 1608 wmic.exe Token: SeBackupPrivilege 1608 wmic.exe Token: SeRestorePrivilege 1608 wmic.exe Token: SeShutdownPrivilege 1608 wmic.exe Token: SeDebugPrivilege 1608 wmic.exe Token: SeSystemEnvironmentPrivilege 1608 wmic.exe Token: SeRemoteShutdownPrivilege 1608 wmic.exe Token: SeUndockPrivilege 1608 wmic.exe Token: SeManageVolumePrivilege 1608 wmic.exe Token: 33 1608 wmic.exe Token: 34 1608 wmic.exe Token: 35 1608 wmic.exe Token: SeIncreaseQuotaPrivilege 1608 wmic.exe Token: SeSecurityPrivilege 1608 wmic.exe Token: SeTakeOwnershipPrivilege 1608 wmic.exe Token: SeLoadDriverPrivilege 1608 wmic.exe Token: SeSystemProfilePrivilege 1608 wmic.exe Token: SeSystemtimePrivilege 1608 wmic.exe Token: SeProfSingleProcessPrivilege 1608 wmic.exe Token: SeIncBasePriorityPrivilege 1608 wmic.exe Token: SeCreatePagefilePrivilege 1608 wmic.exe Token: SeBackupPrivilege 1608 wmic.exe Token: SeRestorePrivilege 1608 wmic.exe Token: SeShutdownPrivilege 1608 wmic.exe Token: SeDebugPrivilege 1608 wmic.exe Token: SeSystemEnvironmentPrivilege 1608 wmic.exe Token: SeRemoteShutdownPrivilege 1608 wmic.exe Token: SeUndockPrivilege 1608 wmic.exe Token: SeManageVolumePrivilege 1608 wmic.exe Token: 33 1608 wmic.exe Token: 34 1608 wmic.exe Token: 35 1608 wmic.exe Token: SeIncreaseQuotaPrivilege 2828 wmic.exe Token: SeSecurityPrivilege 2828 wmic.exe Token: SeTakeOwnershipPrivilege 2828 wmic.exe Token: SeLoadDriverPrivilege 2828 wmic.exe Token: SeSystemProfilePrivilege 2828 wmic.exe Token: SeSystemtimePrivilege 2828 wmic.exe Token: SeProfSingleProcessPrivilege 2828 wmic.exe Token: SeIncBasePriorityPrivilege 2828 wmic.exe Token: SeCreatePagefilePrivilege 2828 wmic.exe Token: SeBackupPrivilege 2828 wmic.exe Token: SeRestorePrivilege 2828 wmic.exe Token: SeShutdownPrivilege 2828 wmic.exe Token: SeDebugPrivilege 2828 wmic.exe Token: SeSystemEnvironmentPrivilege 2828 wmic.exe Token: SeRemoteShutdownPrivilege 2828 wmic.exe Token: SeUndockPrivilege 2828 wmic.exe Token: SeManageVolumePrivilege 2828 wmic.exe Token: 33 2828 wmic.exe Token: 34 2828 wmic.exe Token: 35 2828 wmic.exe Token: SeIncreaseQuotaPrivilege 2504 wmic.exe Token: SeSecurityPrivilege 2504 wmic.exe Token: SeTakeOwnershipPrivilege 2504 wmic.exe Token: SeLoadDriverPrivilege 2504 wmic.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 780 wrote to memory of 2840 780 065495b2fb989af3b0adcbe7dbf05b89_JaffaCakes118.exe 28 PID 780 wrote to memory of 2840 780 065495b2fb989af3b0adcbe7dbf05b89_JaffaCakes118.exe 28 PID 780 wrote to memory of 2840 780 065495b2fb989af3b0adcbe7dbf05b89_JaffaCakes118.exe 28 PID 780 wrote to memory of 2840 780 065495b2fb989af3b0adcbe7dbf05b89_JaffaCakes118.exe 28 PID 2840 wrote to memory of 1608 2840 ecicabfbcafi.exe 29 PID 2840 wrote to memory of 1608 2840 ecicabfbcafi.exe 29 PID 2840 wrote to memory of 1608 2840 ecicabfbcafi.exe 29 PID 2840 wrote to memory of 1608 2840 ecicabfbcafi.exe 29 PID 2840 wrote to memory of 2828 2840 ecicabfbcafi.exe 32 PID 2840 wrote to memory of 2828 2840 ecicabfbcafi.exe 32 PID 2840 wrote to memory of 2828 2840 ecicabfbcafi.exe 32 PID 2840 wrote to memory of 2828 2840 ecicabfbcafi.exe 32 PID 2840 wrote to memory of 2504 2840 ecicabfbcafi.exe 34 PID 2840 wrote to memory of 2504 2840 ecicabfbcafi.exe 34 PID 2840 wrote to memory of 2504 2840 ecicabfbcafi.exe 34 PID 2840 wrote to memory of 2504 2840 ecicabfbcafi.exe 34 PID 2840 wrote to memory of 2640 2840 ecicabfbcafi.exe 36 PID 2840 wrote to memory of 2640 2840 ecicabfbcafi.exe 36 PID 2840 wrote to memory of 2640 2840 ecicabfbcafi.exe 36 PID 2840 wrote to memory of 2640 2840 ecicabfbcafi.exe 36 PID 2840 wrote to memory of 2480 2840 ecicabfbcafi.exe 38 PID 2840 wrote to memory of 2480 2840 ecicabfbcafi.exe 38 PID 2840 wrote to memory of 2480 2840 ecicabfbcafi.exe 38 PID 2840 wrote to memory of 2480 2840 ecicabfbcafi.exe 38 PID 2840 wrote to memory of 3064 2840 ecicabfbcafi.exe 40 PID 2840 wrote to memory of 3064 2840 ecicabfbcafi.exe 40 PID 2840 wrote to memory of 3064 2840 ecicabfbcafi.exe 40 PID 2840 wrote to memory of 3064 2840 ecicabfbcafi.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\065495b2fb989af3b0adcbe7dbf05b89_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\065495b2fb989af3b0adcbe7dbf05b89_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:780 -
C:\Users\Admin\AppData\Local\Temp\ecicabfbcafi.exeC:\Users\Admin\AppData\Local\Temp\ecicabfbcafi.exe 9)1)3)2)1)9)8)2)1)9)7 Jk9GQjwoMTE1KhkmUlJAT0A8Oy8XKEVEUVVOSUNHQzQqHDEtbnFmXHNia2dYbGI7UVxha2BeXhcuQUdSS0FCPCkwLjAvHi46QUI8JxkmT09NQ0w7Ul5APTQxMzczKhgtUjxLTURPXVRJRDtna21nOSwtcmluLEM8TEIsUU1PJDlOTyVCRUVMHi46REdCQkI7PB0tQyg1KzAXKDsxOiswFydCMjQmKB8sQjM0JS8fJj0sPCovHyZIUE47TjpTXE5RQE4/QlA2Fy5NUE47TUFTVj5MSz47HyZIUE47TjpTXExARD07HyY+T0RcU1FDNR4uPFE8XkBLQ0NBTEQ0GSZHTFFTVjpQTk5MPFE6Mx8mTEZARURQTlJdVElEOx8mT0Q8Lx4uO0svPBcoSVRLUkhEPV1WPEU6TkpDSEQ5RURMS0M8HS1ISldQVEVNQExCO3NpbWMfJks8U1JQTUBGRV5MTDxRXEJAUEs7MRcoP0hBQ1c0KR4uQExWQ1ZMQERBQV48RzpRVk5TPDw7ZVhlamQdLUNGT0xLRjo7XkZOPCkoLy0rJy02KzAxLBgtU0BGPDwuMjInKjEvKzEpHyxCTk5GSk44PVZTRktENCwtMS8oKS8uMykpMi8zMS0pKU1LHyZNPzwXKExRSTtna2xuJCpaHDFjIzFdX2NzaSddaGljN1tdcWpraGctYG1sHCpkUWxnS2hqY0Nmb2xrZlpbTF5sYF5dcF5bXmdrbHckKV4wMSkrKTEvMDEpKjAxKR4pZWFtdmVkbWBbZlhtXmVkaR0wZV5eazQzIzJdaCMyWyowMjMxJCkuYiQqXSk2NC8xHCo0axwsWzEzNzMqHTA1ZR4qYy4pb2lnYnRabWVgamMkKlxQZGBmWGZiIzEtXmdrXGdYbGIjMltKY2hkWl5k2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81714347671.txt bios get serialnumber3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1608
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81714347671.txt bios get version3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2828
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81714347671.txt bios get version3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2504
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81714347671.txt bios get version3⤵PID:2640
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81714347671.txt bios get version3⤵PID:2480
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 3683⤵
- Loads dropped DLL
- Program crash
PID:3064
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
66B
MD59025468f85256136f923096b01375964
SHA17fcd174999661594fa5f88890ffb195e9858cc52
SHA256d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df
SHA51292cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51
-
Filesize
764KB
MD568a2c2279ff11e09a5ece9dc0cafd1bf
SHA17065e8201c192992d3228e3bf3730c8b3c5aff51
SHA256966ec883aa9d6a16014468342f33c30e5fb27b9ab72537df1d58d3380fa1641d
SHA512ed77668056f0a2e255356c537fd61bc9c43972c1a1b7639fc399ff30757a5ce02f694829346091d8055e91e615cf6d5c210ce45d264d9dc280a72c50adf2caab
-
Filesize
121KB
MD5a36c4fdf2a6fa3d53efd45137f13c95e
SHA141bc175214429a404b35bd671f65330b4244bf7d
SHA2564606ff886cf287ac12653f1f284f390f047e8f103db8a3b97d3993671371e67d
SHA5126b8cb70f60a035af016e92eb71551c3520b6d79889b04275e8eea4949d17b6e5a09cad5107ee1774af8af9d6efaa9e040bdc1ac1860bd8525f328d77e04eda27
-
Filesize
40KB
MD55f13dbc378792f23e598079fc1e4422b
SHA15813c05802f15930aa860b8363af2b58426c8adf
SHA2566e87ecb7f62039fbb6e7676422d1a5e75a32b90dde6865dcb68ee658ba8df61d
SHA5129270635a5294482f49e0292e26d45dd103b85fe27dc163d44531b095c5f9dbde6b904adaf1a888ba3c112a094380394713c796f5195b2566a20f00b42b6578e5