Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
09-05-2024 18:02
Static task
static1
Behavioral task
behavioral1
Sample
2b339850ba96bb3c8308c70acd7ac521_JaffaCakes118.exe
Resource
win7-20240215-en
General
-
Target
2b339850ba96bb3c8308c70acd7ac521_JaffaCakes118.exe
-
Size
458KB
-
MD5
2b339850ba96bb3c8308c70acd7ac521
-
SHA1
4c497319129abac43989a7a75c4ff8d3fee9554e
-
SHA256
2040586dd9fea01ac08b13748962e9c7ec2bebd618d92543f260984b2eebc352
-
SHA512
bba4a5d960e100295b7e2c33edfbc2e922ca12a92d43a7ec122f4d2dec33579abd38e4ef69134ed8e35bbbb8cc83efcaf7e67f1f5f2dfa6fc4c54bcd29eea401
-
SSDEEP
12288:OSLFxvaN9Se5U17u1KFHeSJ7zdGUvVbCY:rFI9UqKNeSJ7zdGUB
Malware Config
Signatures
-
Loads dropped DLL 5 IoCs
Processes:
WerFault.exepid process 2628 WerFault.exe 2628 WerFault.exe 2628 WerFault.exe 2628 WerFault.exe 2628 WerFault.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2628 2804 WerFault.exe 2b339850ba96bb3c8308c70acd7ac521_JaffaCakes118.exe -
NTFS ADS 2 IoCs
Processes:
cmd.execmd.exedescription ioc process File created C:\Users\Admin\AppData\Local\Temp\2b339850ba96bb3c8308c70acd7ac521_JaffaCakes118.exe:Zone.Identifier cmd.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\2b339850ba96bb3c8308c70acd7ac521_JaffaCakes118.exe:Zone.Identifier cmd.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
2b339850ba96bb3c8308c70acd7ac521_JaffaCakes118.exedescription pid process Token: SeDebugPrivilege 2804 2b339850ba96bb3c8308c70acd7ac521_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
2b339850ba96bb3c8308c70acd7ac521_JaffaCakes118.exedescription pid process target process PID 2804 wrote to memory of 2620 2804 2b339850ba96bb3c8308c70acd7ac521_JaffaCakes118.exe cmd.exe PID 2804 wrote to memory of 2620 2804 2b339850ba96bb3c8308c70acd7ac521_JaffaCakes118.exe cmd.exe PID 2804 wrote to memory of 2620 2804 2b339850ba96bb3c8308c70acd7ac521_JaffaCakes118.exe cmd.exe PID 2804 wrote to memory of 2620 2804 2b339850ba96bb3c8308c70acd7ac521_JaffaCakes118.exe cmd.exe PID 2804 wrote to memory of 2816 2804 2b339850ba96bb3c8308c70acd7ac521_JaffaCakes118.exe cmd.exe PID 2804 wrote to memory of 2816 2804 2b339850ba96bb3c8308c70acd7ac521_JaffaCakes118.exe cmd.exe PID 2804 wrote to memory of 2816 2804 2b339850ba96bb3c8308c70acd7ac521_JaffaCakes118.exe cmd.exe PID 2804 wrote to memory of 2816 2804 2b339850ba96bb3c8308c70acd7ac521_JaffaCakes118.exe cmd.exe PID 2804 wrote to memory of 2628 2804 2b339850ba96bb3c8308c70acd7ac521_JaffaCakes118.exe WerFault.exe PID 2804 wrote to memory of 2628 2804 2b339850ba96bb3c8308c70acd7ac521_JaffaCakes118.exe WerFault.exe PID 2804 wrote to memory of 2628 2804 2b339850ba96bb3c8308c70acd7ac521_JaffaCakes118.exe WerFault.exe PID 2804 wrote to memory of 2628 2804 2b339850ba96bb3c8308c70acd7ac521_JaffaCakes118.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b339850ba96bb3c8308c70acd7ac521_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2b339850ba96bb3c8308c70acd7ac521_JaffaCakes118.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Local\Temp\2b339850ba96bb3c8308c70acd7ac521_JaffaCakes118.exe:Zone.Identifier"2⤵
- NTFS ADS
PID:2620 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Local\Temp\2b339850ba96bb3c8308c70acd7ac521_JaffaCakes118.exe:Zone.Identifier"2⤵
- NTFS ADS
PID:2816 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2804 -s 12162⤵
- Loads dropped DLL
- Program crash
PID:2628
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
458KB
MD52b339850ba96bb3c8308c70acd7ac521
SHA14c497319129abac43989a7a75c4ff8d3fee9554e
SHA2562040586dd9fea01ac08b13748962e9c7ec2bebd618d92543f260984b2eebc352
SHA512bba4a5d960e100295b7e2c33edfbc2e922ca12a92d43a7ec122f4d2dec33579abd38e4ef69134ed8e35bbbb8cc83efcaf7e67f1f5f2dfa6fc4c54bcd29eea401