Analysis
-
max time kernel
122s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04/05/2024, 02:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
113f3b29237cc215538c38a87b30fcfe_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
113f3b29237cc215538c38a87b30fcfe_JaffaCakes118.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
beejheijdj.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
beejheijdj.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
113f3b29237cc215538c38a87b30fcfe_JaffaCakes118.exe
-
Size
370KB
-
MD5
113f3b29237cc215538c38a87b30fcfe
-
SHA1
17824e81117cf811a99cfcdcc83cac7dca7cc97e
-
SHA256
acabe9bffd143477b4acf07062fce95878329330d47480a9ceba837e36af871a
-
SHA512
04bed7f1ddb80edfaff0bb6a5df68785629503f7ac89cad5530324b84c50d99a395982416ab27b41de4fd03234df810517c8e0064615c5201464dfec17b7232b
-
SSDEEP
6144:oFJ0Jw+gt9cEQtLM+S50pe4vMVwW0PNU+sdzWZwzMxyGPR0MI5pKSYi/0ThYP/aD:FwxrcE7X4EwW0PdEWSoVSRgePCD
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2884 beejheijdj.exe -
Loads dropped DLL 5 IoCs
pid Process 2648 113f3b29237cc215538c38a87b30fcfe_JaffaCakes118.exe 2784 WerFault.exe 2784 WerFault.exe 2784 WerFault.exe 2784 WerFault.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 2784 2884 WerFault.exe 28 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2992 wmic.exe Token: SeSecurityPrivilege 2992 wmic.exe Token: SeTakeOwnershipPrivilege 2992 wmic.exe Token: SeLoadDriverPrivilege 2992 wmic.exe Token: SeSystemProfilePrivilege 2992 wmic.exe Token: SeSystemtimePrivilege 2992 wmic.exe Token: SeProfSingleProcessPrivilege 2992 wmic.exe Token: SeIncBasePriorityPrivilege 2992 wmic.exe Token: SeCreatePagefilePrivilege 2992 wmic.exe Token: SeBackupPrivilege 2992 wmic.exe Token: SeRestorePrivilege 2992 wmic.exe Token: SeShutdownPrivilege 2992 wmic.exe Token: SeDebugPrivilege 2992 wmic.exe Token: SeSystemEnvironmentPrivilege 2992 wmic.exe Token: SeRemoteShutdownPrivilege 2992 wmic.exe Token: SeUndockPrivilege 2992 wmic.exe Token: SeManageVolumePrivilege 2992 wmic.exe Token: 33 2992 wmic.exe Token: 34 2992 wmic.exe Token: 35 2992 wmic.exe Token: SeIncreaseQuotaPrivilege 2992 wmic.exe Token: SeSecurityPrivilege 2992 wmic.exe Token: SeTakeOwnershipPrivilege 2992 wmic.exe Token: SeLoadDriverPrivilege 2992 wmic.exe Token: SeSystemProfilePrivilege 2992 wmic.exe Token: SeSystemtimePrivilege 2992 wmic.exe Token: SeProfSingleProcessPrivilege 2992 wmic.exe Token: SeIncBasePriorityPrivilege 2992 wmic.exe Token: SeCreatePagefilePrivilege 2992 wmic.exe Token: SeBackupPrivilege 2992 wmic.exe Token: SeRestorePrivilege 2992 wmic.exe Token: SeShutdownPrivilege 2992 wmic.exe Token: SeDebugPrivilege 2992 wmic.exe Token: SeSystemEnvironmentPrivilege 2992 wmic.exe Token: SeRemoteShutdownPrivilege 2992 wmic.exe Token: SeUndockPrivilege 2992 wmic.exe Token: SeManageVolumePrivilege 2992 wmic.exe Token: 33 2992 wmic.exe Token: 34 2992 wmic.exe Token: 35 2992 wmic.exe Token: SeIncreaseQuotaPrivilege 2612 wmic.exe Token: SeSecurityPrivilege 2612 wmic.exe Token: SeTakeOwnershipPrivilege 2612 wmic.exe Token: SeLoadDriverPrivilege 2612 wmic.exe Token: SeSystemProfilePrivilege 2612 wmic.exe Token: SeSystemtimePrivilege 2612 wmic.exe Token: SeProfSingleProcessPrivilege 2612 wmic.exe Token: SeIncBasePriorityPrivilege 2612 wmic.exe Token: SeCreatePagefilePrivilege 2612 wmic.exe Token: SeBackupPrivilege 2612 wmic.exe Token: SeRestorePrivilege 2612 wmic.exe Token: SeShutdownPrivilege 2612 wmic.exe Token: SeDebugPrivilege 2612 wmic.exe Token: SeSystemEnvironmentPrivilege 2612 wmic.exe Token: SeRemoteShutdownPrivilege 2612 wmic.exe Token: SeUndockPrivilege 2612 wmic.exe Token: SeManageVolumePrivilege 2612 wmic.exe Token: 33 2612 wmic.exe Token: 34 2612 wmic.exe Token: 35 2612 wmic.exe Token: SeIncreaseQuotaPrivilege 2496 wmic.exe Token: SeSecurityPrivilege 2496 wmic.exe Token: SeTakeOwnershipPrivilege 2496 wmic.exe Token: SeLoadDriverPrivilege 2496 wmic.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2648 wrote to memory of 2884 2648 113f3b29237cc215538c38a87b30fcfe_JaffaCakes118.exe 28 PID 2648 wrote to memory of 2884 2648 113f3b29237cc215538c38a87b30fcfe_JaffaCakes118.exe 28 PID 2648 wrote to memory of 2884 2648 113f3b29237cc215538c38a87b30fcfe_JaffaCakes118.exe 28 PID 2648 wrote to memory of 2884 2648 113f3b29237cc215538c38a87b30fcfe_JaffaCakes118.exe 28 PID 2884 wrote to memory of 2992 2884 beejheijdj.exe 29 PID 2884 wrote to memory of 2992 2884 beejheijdj.exe 29 PID 2884 wrote to memory of 2992 2884 beejheijdj.exe 29 PID 2884 wrote to memory of 2992 2884 beejheijdj.exe 29 PID 2884 wrote to memory of 2612 2884 beejheijdj.exe 32 PID 2884 wrote to memory of 2612 2884 beejheijdj.exe 32 PID 2884 wrote to memory of 2612 2884 beejheijdj.exe 32 PID 2884 wrote to memory of 2612 2884 beejheijdj.exe 32 PID 2884 wrote to memory of 2496 2884 beejheijdj.exe 34 PID 2884 wrote to memory of 2496 2884 beejheijdj.exe 34 PID 2884 wrote to memory of 2496 2884 beejheijdj.exe 34 PID 2884 wrote to memory of 2496 2884 beejheijdj.exe 34 PID 2884 wrote to memory of 2644 2884 beejheijdj.exe 36 PID 2884 wrote to memory of 2644 2884 beejheijdj.exe 36 PID 2884 wrote to memory of 2644 2884 beejheijdj.exe 36 PID 2884 wrote to memory of 2644 2884 beejheijdj.exe 36 PID 2884 wrote to memory of 2384 2884 beejheijdj.exe 38 PID 2884 wrote to memory of 2384 2884 beejheijdj.exe 38 PID 2884 wrote to memory of 2384 2884 beejheijdj.exe 38 PID 2884 wrote to memory of 2384 2884 beejheijdj.exe 38 PID 2884 wrote to memory of 2784 2884 beejheijdj.exe 40 PID 2884 wrote to memory of 2784 2884 beejheijdj.exe 40 PID 2884 wrote to memory of 2784 2884 beejheijdj.exe 40 PID 2884 wrote to memory of 2784 2884 beejheijdj.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\113f3b29237cc215538c38a87b30fcfe_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\113f3b29237cc215538c38a87b30fcfe_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\beejheijdj.exeC:\Users\Admin\AppData\Local\Temp\beejheijdj.exe 1\5\0\1\3\2\9\4\5\4\9 LktJQzovMDQvLhcuTlVBTUc7OSscJk1AVFZMUEJFPzknHypESFBSQEA4LBcuPklDOi4XK0tORkNQQ1NcRzs5KxwmUkBSVUJQVlFNSDRnb3RvNy0mb21yJUNAU0oqUkZMKD1HTylJTUNNFys+SEBCRklDOh4mQCw5JDAbL0MvOyQtGys7MjgtMB0tOzA4KSgfKkQ0OisoHCpMSU4/VUJRXUdORFI4QlQ9HyxOSUs/UTpTWkVUST80HCpMSU4/VUJRXUU9SEE0HypFV0JdTE5HORcuQFhEXEFEQEdFRUQ4IC5FTUpQWj5JTlJTRE87LBwqUD9ASUtYTFNWUU1INB8qVkw6MBcrP08oPBsvUVJMS0VIQVZWQExCTEs8RUg9PkRQUks6HiZFTltJVElUSEpDNHBtcVwfKlJEUVNJSkRKPl5QU0RPXTs9VE80MRsvR0ZCPFQ4LRcuRFNeQVdFPUhFOl5ATkJPV0dQQEA0ZVxscmIeJkBKU0VLSkFDXEdHOS0sLy0sMS8rNyoqLC4pHypQQE8/Q0hASFZISVNTPkpDOW9ubGQbL1NGSzw5LDArODMzMzAxKBwqQEZWSUxOPkJWUERJPDwsMi4uLyYuKy0sKSwxOTEzMS8sJjhM2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81714789748.txt bios get serialnumber3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2992
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81714789748.txt bios get version3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2612
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81714789748.txt bios get version3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2496
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81714789748.txt bios get version3⤵PID:2644
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81714789748.txt bios get version3⤵PID:2384
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 3723⤵
- Loads dropped DLL
- Program crash
PID:2784
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
66B
MD59025468f85256136f923096b01375964
SHA17fcd174999661594fa5f88890ffb195e9858cc52
SHA256d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df
SHA51292cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51
-
Filesize
631KB
MD5015bb7953acd60ca049320c4abeae2b5
SHA1450cc3464aaa126e6d8bdad2802093e1b31370d7
SHA2566e8ca330ea3eda3742aeced01248aa645e1f93ee23732512b9bb26dfb5009ef8
SHA51233ec30d87abbf5738fae104fbc2951cd7acee9a45e9299db0bba28b84eb869d5be3b43f7ec93ef1e1577d1a15560649e9aefa7dc48bf124b5a81e7af7b2a2268