217f1551dea3bac786cbee6bd884380bb8b2044a264eb3728d653d006d6adce4

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 14:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3ff3e54f874bad5f34da5d8c5f18b382_JaffaCakes118.exe
Size

581KB
MD5

3ff3e54f874bad5f34da5d8c5f18b382
SHA1

c702fda848915bf060198447e0840baed44e32a1
SHA256

217f1551dea3bac786cbee6bd884380bb8b2044a264eb3728d653d006d6adce4
SHA512

1632b92df06c3129801dbb545aab5a1953d697f86fe27332d0fd96ee98f0b78515308d0da20e209208b195a4c63fb6fb8d7bcdfba4b2d8b7d1736e91adeae356
SSDEEP

12288:jpyuEf1tiYBLrgDhG+u2pGlQBeZwK9jpiptXyaOAMd2:jpNutiYBLr8ljGlQoGK4ROC

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2664	bcfcabfdffh.exe

Loads dropped DLL 10 IoCs

pid	Process
2008	3ff3e54f874bad5f34da5d8c5f18b382_JaffaCakes118.exe
2008	3ff3e54f874bad5f34da5d8c5f18b382_JaffaCakes118.exe
2008	3ff3e54f874bad5f34da5d8c5f18b382_JaffaCakes118.exe
1636	WerFault.exe
1636	WerFault.exe
1636	WerFault.exe
1636	WerFault.exe
1636	WerFault.exe
1636	WerFault.exe
1636	WerFault.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1636	2664	WerFault.exe	28

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1712	wmic.exe
Token: SeSecurityPrivilege	1712	wmic.exe
Token: SeTakeOwnershipPrivilege	1712	wmic.exe
Token: SeLoadDriverPrivilege	1712	wmic.exe
Token: SeSystemProfilePrivilege	1712	wmic.exe
Token: SeSystemtimePrivilege	1712	wmic.exe
Token: SeProfSingleProcessPrivilege	1712	wmic.exe
Token: SeIncBasePriorityPrivilege	1712	wmic.exe
Token: SeCreatePagefilePrivilege	1712	wmic.exe
Token: SeBackupPrivilege	1712	wmic.exe
Token: SeRestorePrivilege	1712	wmic.exe
Token: SeShutdownPrivilege	1712	wmic.exe
Token: SeDebugPrivilege	1712	wmic.exe
Token: SeSystemEnvironmentPrivilege	1712	wmic.exe
Token: SeRemoteShutdownPrivilege	1712	wmic.exe
Token: SeUndockPrivilege	1712	wmic.exe
Token: SeManageVolumePrivilege	1712	wmic.exe
Token: 33	1712	wmic.exe
Token: 34	1712	wmic.exe
Token: 35	1712	wmic.exe
Token: SeIncreaseQuotaPrivilege	1712	wmic.exe
Token: SeSecurityPrivilege	1712	wmic.exe
Token: SeTakeOwnershipPrivilege	1712	wmic.exe
Token: SeLoadDriverPrivilege	1712	wmic.exe
Token: SeSystemProfilePrivilege	1712	wmic.exe
Token: SeSystemtimePrivilege	1712	wmic.exe
Token: SeProfSingleProcessPrivilege	1712	wmic.exe
Token: SeIncBasePriorityPrivilege	1712	wmic.exe
Token: SeCreatePagefilePrivilege	1712	wmic.exe
Token: SeBackupPrivilege	1712	wmic.exe
Token: SeRestorePrivilege	1712	wmic.exe
Token: SeShutdownPrivilege	1712	wmic.exe
Token: SeDebugPrivilege	1712	wmic.exe
Token: SeSystemEnvironmentPrivilege	1712	wmic.exe
Token: SeRemoteShutdownPrivilege	1712	wmic.exe
Token: SeUndockPrivilege	1712	wmic.exe
Token: SeManageVolumePrivilege	1712	wmic.exe
Token: 33	1712	wmic.exe
Token: 34	1712	wmic.exe
Token: 35	1712	wmic.exe
Token: SeIncreaseQuotaPrivilege	2680	wmic.exe
Token: SeSecurityPrivilege	2680	wmic.exe
Token: SeTakeOwnershipPrivilege	2680	wmic.exe
Token: SeLoadDriverPrivilege	2680	wmic.exe
Token: SeSystemProfilePrivilege	2680	wmic.exe
Token: SeSystemtimePrivilege	2680	wmic.exe
Token: SeProfSingleProcessPrivilege	2680	wmic.exe
Token: SeIncBasePriorityPrivilege	2680	wmic.exe
Token: SeCreatePagefilePrivilege	2680	wmic.exe
Token: SeBackupPrivilege	2680	wmic.exe
Token: SeRestorePrivilege	2680	wmic.exe
Token: SeShutdownPrivilege	2680	wmic.exe
Token: SeDebugPrivilege	2680	wmic.exe
Token: SeSystemEnvironmentPrivilege	2680	wmic.exe
Token: SeRemoteShutdownPrivilege	2680	wmic.exe
Token: SeUndockPrivilege	2680	wmic.exe
Token: SeManageVolumePrivilege	2680	wmic.exe
Token: 33	2680	wmic.exe
Token: 34	2680	wmic.exe
Token: 35	2680	wmic.exe
Token: SeIncreaseQuotaPrivilege	2124	wmic.exe
Token: SeSecurityPrivilege	2124	wmic.exe
Token: SeTakeOwnershipPrivilege	2124	wmic.exe
Token: SeLoadDriverPrivilege	2124	wmic.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 2664	2008	3ff3e54f874bad5f34da5d8c5f18b382_JaffaCakes118.exe	28
PID 2008 wrote to memory of 2664	2008	3ff3e54f874bad5f34da5d8c5f18b382_JaffaCakes118.exe	28
PID 2008 wrote to memory of 2664	2008	3ff3e54f874bad5f34da5d8c5f18b382_JaffaCakes118.exe	28
PID 2008 wrote to memory of 2664	2008	3ff3e54f874bad5f34da5d8c5f18b382_JaffaCakes118.exe	28
PID 2664 wrote to memory of 1712	2664	bcfcabfdffh.exe	29
PID 2664 wrote to memory of 1712	2664	bcfcabfdffh.exe	29
PID 2664 wrote to memory of 1712	2664	bcfcabfdffh.exe	29
PID 2664 wrote to memory of 1712	2664	bcfcabfdffh.exe	29
PID 2664 wrote to memory of 2680	2664	bcfcabfdffh.exe	32
PID 2664 wrote to memory of 2680	2664	bcfcabfdffh.exe	32
PID 2664 wrote to memory of 2680	2664	bcfcabfdffh.exe	32
PID 2664 wrote to memory of 2680	2664	bcfcabfdffh.exe	32
PID 2664 wrote to memory of 2124	2664	bcfcabfdffh.exe	34
PID 2664 wrote to memory of 2124	2664	bcfcabfdffh.exe	34
PID 2664 wrote to memory of 2124	2664	bcfcabfdffh.exe	34
PID 2664 wrote to memory of 2124	2664	bcfcabfdffh.exe	34
PID 2664 wrote to memory of 2520	2664	bcfcabfdffh.exe	36
PID 2664 wrote to memory of 2520	2664	bcfcabfdffh.exe	36
PID 2664 wrote to memory of 2520	2664	bcfcabfdffh.exe	36
PID 2664 wrote to memory of 2520	2664	bcfcabfdffh.exe	36
PID 2664 wrote to memory of 2640	2664	bcfcabfdffh.exe	38
PID 2664 wrote to memory of 2640	2664	bcfcabfdffh.exe	38
PID 2664 wrote to memory of 2640	2664	bcfcabfdffh.exe	38
PID 2664 wrote to memory of 2640	2664	bcfcabfdffh.exe	38
PID 2664 wrote to memory of 1636	2664	bcfcabfdffh.exe	40
PID 2664 wrote to memory of 1636	2664	bcfcabfdffh.exe	40
PID 2664 wrote to memory of 1636	2664	bcfcabfdffh.exe	40
PID 2664 wrote to memory of 1636	2664	bcfcabfdffh.exe	40

C:\Users\Admin\AppData\Local\Temp\3ff3e54f874bad5f34da5d8c5f18b382_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3ff3e54f874bad5f34da5d8c5f18b382_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Users\Admin\AppData\Local\Temp\bcfcabfdffh.exe
  C:\Users\Admin\AppData\Local\Temp\bcfcabfdffh.exe 6-3-3-3-7-3-9-3-2-1-5 KU1GQTYuLy02MRspUFI/SUY7Oi4fKkhCUVRIT0JGQjwsGixBRkxRQEE7MS8qLjIdKEBAQTsvGylNT0w9UjpRXUg/Ny8wLyo0FyxRRE1QQk9cTk9DOmZzb2o3LCxsYmlzLHNjXypebWkqW15yYClja2NsGSw6SUdCRkNBOh0oQSg6KzAbKUEvOiYuFyxCMjgnLh0sPTE0Ki8fKj4yOioqHSZNUE4/T0BRXElPQFM/QlQ3HSxNS0w7UkFTWj9SST42HSZNUE4/T0BRXEc+REI7QHBubEA+PSIpLTAvLC4iLy0rLSgxHi5AUkJcUktJNGVyc2s0LCxtXyttZnJvZ1txY2xraiVgbWwqXW9edGViW1xxbmFuLC8sLCxgYW5lKF9ed2JlYycuLnlfW2MtMC9jKDUuYi8sLjIvXV5cMWNkLDM1NjIyMy4vNixvY2QqMi1gLC8yMV0vLWJeLzMlMzcyLysxNi8mYF9vbWxgJ2ZhbV8sYGFuZShfXndiZWMnLy55X1tjLTAvYyg1LmIvLC4yL11eXDFjZCwzNTYyMjMuLzYsam9xKjItYCwvMjFdLy1iXi8zJTM3Mi8rMTYvJmBfb21sYCdmYW1fLCkwLjQuLyozNCoxLTYrYHBubGBeXSopLS8zKV91Yh0oQk9CXUJIPklGSz46FyxGTk5OXD9PSFRKQlA8LRosUUU6S0JWTVRaT09JOmFxa204LipxdHQrbWVYa2lyKV9ed2JlK1psay5kaGFidSdtX209Y2g3Y29iZ2BfK2NgdV9pK2Boah1taXY4Pz5XQkVDSSNuZjg7cnFsPD47IjAvLSouMSIrLSktLzMhaWQ6UD5MHXFwYmZjYTojWmNdZmI8IWV0OiNpalsyOyVkaHBxXmVpXG87OBspU0o6Kx0mQVEwOD8+V0JFQycvLllfW2MtMC9jKDUuYi8sLjIvXV5cMWN
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2664
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81715610872.txt bios get serialnumber
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1712
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81715610872.txt bios get version
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2680
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81715610872.txt bios get version
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2124
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81715610872.txt bios get version
    3⤵
    PID:2520
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81715610872.txt bios get version
    3⤵
    PID:2640
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 368
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:1636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\81715610872.txt

Filesize
66B

MD5
9025468f85256136f923096b01375964

SHA1
7fcd174999661594fa5f88890ffb195e9858cc52

SHA256
d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df

SHA512
92cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51

Download Submit
\Users\Admin\AppData\Local\Temp\bcfcabfdffh.exe

Filesize
822KB

MD5
3e31cf9e369a001cd786b8db5d3c954f

SHA1
01b14d35e9f1a87ce9f6be314fdfb9942083b580

SHA256
ab882565e7e91a628c969f4c80bea3c3c43a9ed420b946d4718944d39bf55b14

SHA512
80c6dcba8991b47c2f4ac48e5660b6827be7b3a90aa67188386559f03280565ad12aa9dbcd743ad04e210b84113fa118de0b75c62c9b91027dcd567cee0e72bb

Download Submit
\Users\Admin\AppData\Local\Temp\nst3F8.tmp\eor.dll

Filesize
125KB

MD5
3266e5a3b1f35e8e1db52210397c2a35

SHA1
b26b573f303e8b5445a0e418645afc518dab3450

SHA256
77cb2ff9ad91fbe2fc37dcf4d24bbeae9f71973806087d2eb53c15021e049da0

SHA512
f931a49ce9eec79b853987e34a3b72ce31c6489f9fbda62c2f4bf6f3e58360d1c96fc7f2fe9a297c8975f4fce40344da75bd2d39ca8f1e40bbde9ef32dba0ce2

Download Submit
\Users\Admin\AppData\Local\Temp\nst3F8.tmp\nsisunz.dll

Filesize
40KB

MD5
5f13dbc378792f23e598079fc1e4422b

SHA1
5813c05802f15930aa860b8363af2b58426c8adf

SHA256
6e87ecb7f62039fbb6e7676422d1a5e75a32b90dde6865dcb68ee658ba8df61d

SHA512
9270635a5294482f49e0292e26d45dd103b85fe27dc163d44531b095c5f9dbde6b904adaf1a888ba3c112a094380394713c796f5195b2566a20f00b42b6578e5

Download Submit