Analysis

  • max time kernel
    117s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    10/05/2024, 09:13 UTC

General

  • Target

    2e6503294a603a34707cf57c20d31a23_JaffaCakes118.exe

  • Size

    557KB

  • MD5

    2e6503294a603a34707cf57c20d31a23

  • SHA1

    b2c70f2282e9bf0701b4b427bfde86c1d90c2013

  • SHA256

    209dd9c494e998a20ef1e4e8c919182751ad0465916246b467a08815a591d37b

  • SHA512

    c14ee8b86e31bd9f36086f604cbd0c7e1c419851b1c0a56f0a5369f4faf2acd40a298067a73a74d5d0eb6c997d7ad5bdc372d45d420d822f2f9dab0818fe5489

  • SSDEEP

    12288:TzbIXVXQ20G2x2eaHP8xWVEabZGwMmMTkkYbQQVttiL9KonkSIIjA:Tz0XFQfG2EeQ0gEaNaThYhfSsIc

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 10 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2e6503294a603a34707cf57c20d31a23_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\2e6503294a603a34707cf57c20d31a23_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2032
    • C:\Users\Admin\AppData\Local\Temp\ebbcabfbcdgg.exe
      C:\Users\Admin\AppData\Local\Temp\ebbcabfbcdgg.exe 0-9-5-1-9-7-0-6-4-7-4 L0dEQzQqMywyLhwvSlBBR0JENywZK048T1ZGS0tDQDYtICY/SEpNST45KjQ5LisfJjxJPjkpHC9HTU47TkNOW0JAPSgzMCkyIClPPk5WPE1eTEtMN2RtcHAxKi5qa3YoQD5PSyRPTkcmQUpMJ0VOPUofJjxMQz9ERUQ0Gy47Kj0sLhkrRCk4LCgZLz4vNikxFypDKzYtKxwoQDU0KDAXKFBMSz1RQ0taT0lCVjs/UjkgJktRRj1VPVBYQVVDPDwXKFBMSz1RQ0taTThGRTdlZl1nXFpsWGx0X25iamdWXG9gWHYsWylbaWRcb2BvMlksWGJvaVp2YGdkaXNsWzcXKkRPPl9PTkU5ICZAVzxYQ0dARUVOPDgfJkFPTVBYPlJGUlI8Sz0sHChQSDhJSlBIVVlRS0g9FypVRDYyGis9TzE0Gy5JTk5ORUZBX05ASzpITT9FRj1HPFBRQzYgKUVMW1JMSVNARkU3cGtxZRcqUTxNVUxKQkpHVlBSPEtfPj1STz0pGy4/QkQ/VDYtICZEUlY9WUg9RkVDVkBNOktZSlA+QD1dXGtqXiApQEhTTkNKQDtYSUo5LTUuKC83JTE3KC4qMiAmT0hEPj0rMCs0NygtLycsIClASFNOQ0pAO1hUQ0k+OTQmLDAmKzArMSMtMjEtNTEtMyQ9Rg==
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1296
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81715332391.txt bios get serialnumber
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2196
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81715332391.txt bios get version
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2500
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81715332391.txt bios get version
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2644
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81715332391.txt bios get version
        3⤵
          PID:2156
        • C:\Windows\SysWOW64\Wbem\wmic.exe
          wmic /output:C:\Users\Admin\AppData\Local\Temp\81715332391.txt bios get version
          3⤵
            PID:2488
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1296 -s 372
            3⤵
            • Loads dropped DLL
            • Program crash
            PID:2868

      Network

      • flag-us
        DNS
        srv.desk-top-app.info
        ebbcabfbcdgg.exe
        Remote address:
        8.8.8.8:53
        Request
        srv.desk-top-app.info
        IN A
        Response
      No results found
      • 8.8.8.8:53
        srv.desk-top-app.info
        dns
        ebbcabfbcdgg.exe
        67 B
        146 B
        1
        1

        DNS Request

        srv.desk-top-app.info

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\81715332391.txt

        Filesize

        66B

        MD5

        9025468f85256136f923096b01375964

        SHA1

        7fcd174999661594fa5f88890ffb195e9858cc52

        SHA256

        d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df

        SHA512

        92cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51

      • \Users\Admin\AppData\Local\Temp\ebbcabfbcdgg.exe

        Filesize

        764KB

        MD5

        c025e4eceb505d47266b354bb68021ae

        SHA1

        95bab1740d3e5033e849f3daa20088e7200ff08c

        SHA256

        48f1da840c627aac3d66922975755ed96e01295b707b6306cf666c957fc97456

        SHA512

        22145308ed6b9980cbff1b83bac269767b67e677538b9cdffcb5f27492306c17e1423a8ef6c906ea9ba68ac090e61fe080d363f5c75b001f0bf28c60a27c9e07

      • \Users\Admin\AppData\Local\Temp\nso7C33.tmp\awqcm.dll

        Filesize

        125KB

        MD5

        bd4a88ce594510d5c100c00dd75dceb0

        SHA1

        2e09b83ac1c806a37bca5fe79a972886910a3e80

        SHA256

        d32f5eb2d1a70638ed995eeb4f626f3ebb71e43127b9539c778ad594d0d2b29c

        SHA512

        0bfe7fbd6fc84202048b4bd92b8323edee6a712a256f2d26a3041ac5e64ec90de32692800151cdb7e590f3b286c893374fb8bf023c3123a7c2a4ebc8dfff2033

      • \Users\Admin\AppData\Local\Temp\nso7C33.tmp\nsisunz.dll

        Filesize

        40KB

        MD5

        5f13dbc378792f23e598079fc1e4422b

        SHA1

        5813c05802f15930aa860b8363af2b58426c8adf

        SHA256

        6e87ecb7f62039fbb6e7676422d1a5e75a32b90dde6865dcb68ee658ba8df61d

        SHA512

        9270635a5294482f49e0292e26d45dd103b85fe27dc163d44531b095c5f9dbde6b904adaf1a888ba3c112a094380394713c796f5195b2566a20f00b42b6578e5

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.