21c8bb4e7a319d0d7e6ed302de1224094bc6d59b3cd73bb30527c831bc4a8303

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/05/2024, 09:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

121fb174f56325c6654de4503c7f3746_JaffaCakes118.exe
Size

759KB
MD5

121fb174f56325c6654de4503c7f3746
SHA1

ddc6e9b2f8333d71e9057b07ff780e7faf14bb3c
SHA256

21c8bb4e7a319d0d7e6ed302de1224094bc6d59b3cd73bb30527c831bc4a8303
SHA512

8f65ee11e66e2d71d4d030953b6ae1c6aa4b0941d7c99f6069a305199d28bf1f0c347a80221c535002b3ab97bb8b56544fe30561d1776a7cafa4d617cf6af21e
SSDEEP

12288:9qt53Ys2ZELwbbuMc0ckdSq7yvRajGvuUrSRynv9rVlwVALGZkZPCfCvIqLmwl5N:9qAs2ZEL8CM3cuvQajAuYnvUucOUWlX/

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2660	1432479682.exe

Loads dropped DLL 11 IoCs

pid	Process
2932	121fb174f56325c6654de4503c7f3746_JaffaCakes118.exe
2932	121fb174f56325c6654de4503c7f3746_JaffaCakes118.exe
2932	121fb174f56325c6654de4503c7f3746_JaffaCakes118.exe
2932	121fb174f56325c6654de4503c7f3746_JaffaCakes118.exe
2760	WerFault.exe
2760	WerFault.exe
2760	WerFault.exe
2760	WerFault.exe
2760	WerFault.exe
2760	WerFault.exe
2760	WerFault.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2760	2660	WerFault.exe	28

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2820	wmic.exe
Token: SeSecurityPrivilege	2820	wmic.exe
Token: SeTakeOwnershipPrivilege	2820	wmic.exe
Token: SeLoadDriverPrivilege	2820	wmic.exe
Token: SeSystemProfilePrivilege	2820	wmic.exe
Token: SeSystemtimePrivilege	2820	wmic.exe
Token: SeProfSingleProcessPrivilege	2820	wmic.exe
Token: SeIncBasePriorityPrivilege	2820	wmic.exe
Token: SeCreatePagefilePrivilege	2820	wmic.exe
Token: SeBackupPrivilege	2820	wmic.exe
Token: SeRestorePrivilege	2820	wmic.exe
Token: SeShutdownPrivilege	2820	wmic.exe
Token: SeDebugPrivilege	2820	wmic.exe
Token: SeSystemEnvironmentPrivilege	2820	wmic.exe
Token: SeRemoteShutdownPrivilege	2820	wmic.exe
Token: SeUndockPrivilege	2820	wmic.exe
Token: SeManageVolumePrivilege	2820	wmic.exe
Token: 33	2820	wmic.exe
Token: 34	2820	wmic.exe
Token: 35	2820	wmic.exe
Token: SeIncreaseQuotaPrivilege	2820	wmic.exe
Token: SeSecurityPrivilege	2820	wmic.exe
Token: SeTakeOwnershipPrivilege	2820	wmic.exe
Token: SeLoadDriverPrivilege	2820	wmic.exe
Token: SeSystemProfilePrivilege	2820	wmic.exe
Token: SeSystemtimePrivilege	2820	wmic.exe
Token: SeProfSingleProcessPrivilege	2820	wmic.exe
Token: SeIncBasePriorityPrivilege	2820	wmic.exe
Token: SeCreatePagefilePrivilege	2820	wmic.exe
Token: SeBackupPrivilege	2820	wmic.exe
Token: SeRestorePrivilege	2820	wmic.exe
Token: SeShutdownPrivilege	2820	wmic.exe
Token: SeDebugPrivilege	2820	wmic.exe
Token: SeSystemEnvironmentPrivilege	2820	wmic.exe
Token: SeRemoteShutdownPrivilege	2820	wmic.exe
Token: SeUndockPrivilege	2820	wmic.exe
Token: SeManageVolumePrivilege	2820	wmic.exe
Token: 33	2820	wmic.exe
Token: 34	2820	wmic.exe
Token: 35	2820	wmic.exe
Token: SeIncreaseQuotaPrivilege	2484	wmic.exe
Token: SeSecurityPrivilege	2484	wmic.exe
Token: SeTakeOwnershipPrivilege	2484	wmic.exe
Token: SeLoadDriverPrivilege	2484	wmic.exe
Token: SeSystemProfilePrivilege	2484	wmic.exe
Token: SeSystemtimePrivilege	2484	wmic.exe
Token: SeProfSingleProcessPrivilege	2484	wmic.exe
Token: SeIncBasePriorityPrivilege	2484	wmic.exe
Token: SeCreatePagefilePrivilege	2484	wmic.exe
Token: SeBackupPrivilege	2484	wmic.exe
Token: SeRestorePrivilege	2484	wmic.exe
Token: SeShutdownPrivilege	2484	wmic.exe
Token: SeDebugPrivilege	2484	wmic.exe
Token: SeSystemEnvironmentPrivilege	2484	wmic.exe
Token: SeRemoteShutdownPrivilege	2484	wmic.exe
Token: SeUndockPrivilege	2484	wmic.exe
Token: SeManageVolumePrivilege	2484	wmic.exe
Token: 33	2484	wmic.exe
Token: 34	2484	wmic.exe
Token: 35	2484	wmic.exe
Token: SeIncreaseQuotaPrivilege	2692	wmic.exe
Token: SeSecurityPrivilege	2692	wmic.exe
Token: SeTakeOwnershipPrivilege	2692	wmic.exe
Token: SeLoadDriverPrivilege	2692	wmic.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2660	2932	121fb174f56325c6654de4503c7f3746_JaffaCakes118.exe	28
PID 2932 wrote to memory of 2660	2932	121fb174f56325c6654de4503c7f3746_JaffaCakes118.exe	28
PID 2932 wrote to memory of 2660	2932	121fb174f56325c6654de4503c7f3746_JaffaCakes118.exe	28
PID 2932 wrote to memory of 2660	2932	121fb174f56325c6654de4503c7f3746_JaffaCakes118.exe	28
PID 2660 wrote to memory of 2820	2660	1432479682.exe	29
PID 2660 wrote to memory of 2820	2660	1432479682.exe	29
PID 2660 wrote to memory of 2820	2660	1432479682.exe	29
PID 2660 wrote to memory of 2820	2660	1432479682.exe	29
PID 2660 wrote to memory of 2484	2660	1432479682.exe	32
PID 2660 wrote to memory of 2484	2660	1432479682.exe	32
PID 2660 wrote to memory of 2484	2660	1432479682.exe	32
PID 2660 wrote to memory of 2484	2660	1432479682.exe	32
PID 2660 wrote to memory of 2692	2660	1432479682.exe	34
PID 2660 wrote to memory of 2692	2660	1432479682.exe	34
PID 2660 wrote to memory of 2692	2660	1432479682.exe	34
PID 2660 wrote to memory of 2692	2660	1432479682.exe	34
PID 2660 wrote to memory of 2516	2660	1432479682.exe	36
PID 2660 wrote to memory of 2516	2660	1432479682.exe	36
PID 2660 wrote to memory of 2516	2660	1432479682.exe	36
PID 2660 wrote to memory of 2516	2660	1432479682.exe	36
PID 2660 wrote to memory of 2708	2660	1432479682.exe	38
PID 2660 wrote to memory of 2708	2660	1432479682.exe	38
PID 2660 wrote to memory of 2708	2660	1432479682.exe	38
PID 2660 wrote to memory of 2708	2660	1432479682.exe	38
PID 2660 wrote to memory of 2760	2660	1432479682.exe	40
PID 2660 wrote to memory of 2760	2660	1432479682.exe	40
PID 2660 wrote to memory of 2760	2660	1432479682.exe	40
PID 2660 wrote to memory of 2760	2660	1432479682.exe	40

C:\Users\Admin\AppData\Local\Temp\121fb174f56325c6654de4503c7f3746_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\121fb174f56325c6654de4503c7f3746_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Users\Admin\AppData\Local\Temp\1432479682.exe
  C:\Users\Admin\AppData\Local\Temp\1432479682.exe 8/7/0/7/8/7/0/6/6/9/2 J0lJPTUtODAtFy1LTkJJQT09KhomTD1NV0hKREk+NygeJz1JTExCRDcwLDQxGS88QT09KhomTkpIRE47TV9DPjQ0KS45GSdMRUxQPFBXTlJFNWF0bmoxLSdscm8mPUVNRSRSR0ktOkhJLkNIPU0YKENFQTxLQz40Hic9MTYlKiApPik7JSogKDwsPScrFy08LT0mKRkvPi80KykZL0lKSERPPUtdSEtJTzk8WTcaJk5KSEROO01fP09DPzUZL0lKSERPPUtdRjpNPjVMa3NqXCwvJzInKCcxGik8Vj1YVUtENiApP09DVzxNPURCTj83Fy1ASFNNVztSSVFKQ0o2MRknTUg7SEJXR05fTkpFPRopTUs1KyAoPEwxNxomUE1HVEJFPl9RP0NBR0ZFQkU6Rz9PSUo1GS9CS1hST0hLR0U+PW1qbmUaKUlDTE5SR0FHR1lPSkNKWEQ6UUw9LBomRkE9RVE1KiApQ0pdPFJOOkVCQ1k/RUFKUlBNPT09YFtjcV0ZLz1HUE5GSThCV0JQNjAtLiszKiwqKjYnLywgKU5ASz02MS0rKzQyLy0vMRkvPUdQTkZJOEJXTUlGPTY1KSwrLSopMS4iLTouKjEvMSNQRg==
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2660
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81714815295.txt bios get serialnumber
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2820
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81714815295.txt bios get version
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2484
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81714815295.txt bios get version
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2692
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81714815295.txt bios get version
    3⤵
    PID:2516
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81714815295.txt bios get version
    3⤵
    PID:2708
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2660 -s 368
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\81714815295.txt

Filesize
66B

MD5
9025468f85256136f923096b01375964

SHA1
7fcd174999661594fa5f88890ffb195e9858cc52

SHA256
d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df

SHA512
92cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51

Download Submit
\Users\Admin\AppData\Local\Temp\1432479682.exe

Filesize
1021KB

MD5
dc38edd9d976a8876c1bbf40c1942a45

SHA1
709774697978744b750eb84f738023b800697285

SHA256
1257bce6f5a1170ccb30ab40388e4c91351e936aa4d1875d2c849c0c02292f70

SHA512
ccab60c9f83c8d0f46b3ff0ab6b2fbdd753ec452324d26e724d1f18732d5284a6f310463c1643535dd8ea789765d48fa7e0cb69cadab2f7fcd44587f41a10d3e

Download Submit
\Users\Admin\AppData\Local\Temp\nsd123A.tmp\ZipDLL.dll

Filesize
163KB

MD5
2dc35ddcabcb2b24919b9afae4ec3091

SHA1
9eeed33c3abc656353a7ebd1c66af38cccadd939

SHA256
6bbeb39747f1526752980d4dbec2fe2c7347f3cc983a79c92561b92fe472e7a1

SHA512
0ccac336924f684da1f73db2dd230a0c932c5b4115ae1fa0e708b9db5e39d2a07dc54dac8d95881a42069cbb2c2886e880cdad715deda83c0de38757a0f6a901

Download Submit
\Users\Admin\AppData\Local\Temp\nsd123A.tmp\iymcmjl.dll

Filesize
158KB

MD5
244bfdfa02fe19e4655cb60825479728

SHA1
84dcbef27afbd61506244d30e827010b6b7bd5a8

SHA256
185a96047be801c6dbfb2da7e3f3be5ea6a5abf30975d0ff4250247eb2e920b2

SHA512
abadfc47a95183b387553b520861d3f2251d38b17721589ab749c46069e7c32461b1f180278fd45c01a66b59382f79d9b3b33b8d88042e709858ee3f5727a766

Download Submit