217f1551dea3bac786cbee6bd884380bb8b2044a264eb3728d653d006d6adce4

Analysis

max time kernel
141s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/05/2024, 14:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3ff3e54f874bad5f34da5d8c5f18b382_JaffaCakes118.exe
Size

581KB
MD5

3ff3e54f874bad5f34da5d8c5f18b382
SHA1

c702fda848915bf060198447e0840baed44e32a1
SHA256

217f1551dea3bac786cbee6bd884380bb8b2044a264eb3728d653d006d6adce4
SHA512

1632b92df06c3129801dbb545aab5a1953d697f86fe27332d0fd96ee98f0b78515308d0da20e209208b195a4c63fb6fb8d7bcdfba4b2d8b7d1736e91adeae356
SSDEEP

12288:jpyuEf1tiYBLrgDhG+u2pGlQBeZwK9jpiptXyaOAMd2:jpNutiYBLr8ljGlQoGK4ROC

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1444	bcfcabfdffh.exe

Loads dropped DLL 2 IoCs

pid	Process
4188	3ff3e54f874bad5f34da5d8c5f18b382_JaffaCakes118.exe
4188	3ff3e54f874bad5f34da5d8c5f18b382_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4892	1444	WerFault.exe	91

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4988	wmic.exe
Token: SeSecurityPrivilege	4988	wmic.exe
Token: SeTakeOwnershipPrivilege	4988	wmic.exe
Token: SeLoadDriverPrivilege	4988	wmic.exe
Token: SeSystemProfilePrivilege	4988	wmic.exe
Token: SeSystemtimePrivilege	4988	wmic.exe
Token: SeProfSingleProcessPrivilege	4988	wmic.exe
Token: SeIncBasePriorityPrivilege	4988	wmic.exe
Token: SeCreatePagefilePrivilege	4988	wmic.exe
Token: SeBackupPrivilege	4988	wmic.exe
Token: SeRestorePrivilege	4988	wmic.exe
Token: SeShutdownPrivilege	4988	wmic.exe
Token: SeDebugPrivilege	4988	wmic.exe
Token: SeSystemEnvironmentPrivilege	4988	wmic.exe
Token: SeRemoteShutdownPrivilege	4988	wmic.exe
Token: SeUndockPrivilege	4988	wmic.exe
Token: SeManageVolumePrivilege	4988	wmic.exe
Token: 33	4988	wmic.exe
Token: 34	4988	wmic.exe
Token: 35	4988	wmic.exe
Token: 36	4988	wmic.exe
Token: SeIncreaseQuotaPrivilege	4988	wmic.exe
Token: SeSecurityPrivilege	4988	wmic.exe
Token: SeTakeOwnershipPrivilege	4988	wmic.exe
Token: SeLoadDriverPrivilege	4988	wmic.exe
Token: SeSystemProfilePrivilege	4988	wmic.exe
Token: SeSystemtimePrivilege	4988	wmic.exe
Token: SeProfSingleProcessPrivilege	4988	wmic.exe
Token: SeIncBasePriorityPrivilege	4988	wmic.exe
Token: SeCreatePagefilePrivilege	4988	wmic.exe
Token: SeBackupPrivilege	4988	wmic.exe
Token: SeRestorePrivilege	4988	wmic.exe
Token: SeShutdownPrivilege	4988	wmic.exe
Token: SeDebugPrivilege	4988	wmic.exe
Token: SeSystemEnvironmentPrivilege	4988	wmic.exe
Token: SeRemoteShutdownPrivilege	4988	wmic.exe
Token: SeUndockPrivilege	4988	wmic.exe
Token: SeManageVolumePrivilege	4988	wmic.exe
Token: 33	4988	wmic.exe
Token: 34	4988	wmic.exe
Token: 35	4988	wmic.exe
Token: 36	4988	wmic.exe
Token: SeIncreaseQuotaPrivilege	2612	wmic.exe
Token: SeSecurityPrivilege	2612	wmic.exe
Token: SeTakeOwnershipPrivilege	2612	wmic.exe
Token: SeLoadDriverPrivilege	2612	wmic.exe
Token: SeSystemProfilePrivilege	2612	wmic.exe
Token: SeSystemtimePrivilege	2612	wmic.exe
Token: SeProfSingleProcessPrivilege	2612	wmic.exe
Token: SeIncBasePriorityPrivilege	2612	wmic.exe
Token: SeCreatePagefilePrivilege	2612	wmic.exe
Token: SeBackupPrivilege	2612	wmic.exe
Token: SeRestorePrivilege	2612	wmic.exe
Token: SeShutdownPrivilege	2612	wmic.exe
Token: SeDebugPrivilege	2612	wmic.exe
Token: SeSystemEnvironmentPrivilege	2612	wmic.exe
Token: SeRemoteShutdownPrivilege	2612	wmic.exe
Token: SeUndockPrivilege	2612	wmic.exe
Token: SeManageVolumePrivilege	2612	wmic.exe
Token: 33	2612	wmic.exe
Token: 34	2612	wmic.exe
Token: 35	2612	wmic.exe
Token: 36	2612	wmic.exe
Token: SeIncreaseQuotaPrivilege	2612	wmic.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4188 wrote to memory of 1444	4188	3ff3e54f874bad5f34da5d8c5f18b382_JaffaCakes118.exe	91
PID 4188 wrote to memory of 1444	4188	3ff3e54f874bad5f34da5d8c5f18b382_JaffaCakes118.exe	91
PID 4188 wrote to memory of 1444	4188	3ff3e54f874bad5f34da5d8c5f18b382_JaffaCakes118.exe	91
PID 1444 wrote to memory of 4988	1444	bcfcabfdffh.exe	92
PID 1444 wrote to memory of 4988	1444	bcfcabfdffh.exe	92
PID 1444 wrote to memory of 4988	1444	bcfcabfdffh.exe	92
PID 1444 wrote to memory of 2612	1444	bcfcabfdffh.exe	95
PID 1444 wrote to memory of 2612	1444	bcfcabfdffh.exe	95
PID 1444 wrote to memory of 2612	1444	bcfcabfdffh.exe	95
PID 1444 wrote to memory of 1188	1444	bcfcabfdffh.exe	97
PID 1444 wrote to memory of 1188	1444	bcfcabfdffh.exe	97
PID 1444 wrote to memory of 1188	1444	bcfcabfdffh.exe	97
PID 1444 wrote to memory of 3496	1444	bcfcabfdffh.exe	99
PID 1444 wrote to memory of 3496	1444	bcfcabfdffh.exe	99
PID 1444 wrote to memory of 3496	1444	bcfcabfdffh.exe	99
PID 1444 wrote to memory of 3452	1444	bcfcabfdffh.exe	101
PID 1444 wrote to memory of 3452	1444	bcfcabfdffh.exe	101
PID 1444 wrote to memory of 3452	1444	bcfcabfdffh.exe	101

C:\Users\Admin\AppData\Local\Temp\3ff3e54f874bad5f34da5d8c5f18b382_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3ff3e54f874bad5f34da5d8c5f18b382_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4188
- C:\Users\Admin\AppData\Local\Temp\bcfcabfdffh.exe
  C:\Users\Admin\AppData\Local\Temp\bcfcabfdffh.exe 6-3-3-3-7-3-9-3-2-1-5 KU1GQTYuLy02MRspUFI/SUY7Oi4fKkhCUVRIT0JGQjwsGixBRkxRQEE7MS8qLjIdKEBAQTsvGylNT0w9UjpRXUg/Ny8wLyo0FyxRRE1QQk9cTk9DOmZzb2o3LCxsYmlzLHNjXypebWkqW15yYClja2NsGSw6SUdCRkNBOh0oQSg6KzAbKUEvOiYuFyxCMjgnLh0sPTE0Ki8fKj4yOioqHSZNUE4/T0BRXElPQFM/QlQ3HSxNS0w7UkFTWj9SST42HSZNUE4/T0BRXEc+REI7QHBubEA+PSIpLTAvLC4iLy0rLSgxHi5AUkJcUktJNGVyc2s0LCxtXyttZnJvZ1txY2xraiVgbWwqXW9edGViW1xxbmFuLC8sLCxgYW5lKF9ed2JlYycuLnlfW2MtMC9jKDUuYi8sLjIvXV5cMWNkLDM1NjIyMy4vNixvY2QqMi1gLC8yMV0vLWJeLzMlMzcyLysxNi8mYF9vbWxgJ2ZhbV8sYGFuZShfXndiZWMnLy55X1tjLTAvYyg1LmIvLC4yL11eXDFjZCwzNTYyMjMuLzYsam9xKjItYCwvMjFdLy1iXi8zJTM3Mi8rMTYvJmBfb21sYCdmYW1fLCkwLjQuLyozNCoxLTYrYHBubGBeXSopLS8zKV91Yh0oQk9CXUJIPklGSz46FyxGTk5OXD9PSFRKQlA8LRosUUU6S0JWTVRaT09JOmFxa204LipxdHQrbWVYa2lyKV9ed2JlK1psay5kaGFidSdtX209Y2g3Y29iZ2BfK2NgdV9pK2Boah1taXY4Pz5XQkVDSSNuZjg7cnFsPD47IjAvLSouMSIrLSktLzMhaWQ6UD5MHXFwYmZjYTojWmNdZmI8IWV0OiNpalsyOyVkaHBxXmVpXG87OBspU0o6Kx0mQVEwOD8+V0JFQycvLllfW2MtMC9jKDUuYi8sLjIvXV5cMWN
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1444
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81715610883.txt bios get serialnumber
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4988
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81715610883.txt bios get version
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2612
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81715610883.txt bios get version
    3⤵
    PID:1188
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81715610883.txt bios get version
    3⤵
    PID:3496
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81715610883.txt bios get version
    3⤵
    PID:3452
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1444 -s 856
    3⤵
    - Program crash
    PID:4892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1444 -ip 1444
1⤵
PID:2368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3888 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:8
1⤵
PID:2268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\81715610883.txt

Filesize
66B

MD5
9025468f85256136f923096b01375964

SHA1
7fcd174999661594fa5f88890ffb195e9858cc52

SHA256
d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df

SHA512
92cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51

Download Submit
C:\Users\Admin\AppData\Local\Temp\81715610883.txt

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Local\Temp\81715610883.txt

Filesize
58B

MD5
dd876faf0fd44a5fab3e82368e2e8b15

SHA1
01b04083fa278dda3a81705ca5abcfee487a3c90

SHA256
5602490a82bcacec8797d25cbb6f643fc9e69f89a2f0e6ec1e8d1f568e77a6b9

SHA512
e03d1def5b7fb0ed01a414cead199229ec0e153ff831d3ff5dd36c320572084c56a5e1369c753f868c855455758c0d308941b6187c348051419bd937d014cb8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\bcfcabfdffh.exe

Filesize
822KB

MD5
3e31cf9e369a001cd786b8db5d3c954f

SHA1
01b14d35e9f1a87ce9f6be314fdfb9942083b580

SHA256
ab882565e7e91a628c969f4c80bea3c3c43a9ed420b946d4718944d39bf55b14

SHA512
80c6dcba8991b47c2f4ac48e5660b6827be7b3a90aa67188386559f03280565ad12aa9dbcd743ad04e210b84113fa118de0b75c62c9b91027dcd567cee0e72bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsyF4C1.tmp\eor.dll

Filesize
125KB

MD5
3266e5a3b1f35e8e1db52210397c2a35

SHA1
b26b573f303e8b5445a0e418645afc518dab3450

SHA256
77cb2ff9ad91fbe2fc37dcf4d24bbeae9f71973806087d2eb53c15021e049da0

SHA512
f931a49ce9eec79b853987e34a3b72ce31c6489f9fbda62c2f4bf6f3e58360d1c96fc7f2fe9a297c8975f4fce40344da75bd2d39ca8f1e40bbde9ef32dba0ce2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsyF4C1.tmp\nsisunz.dll

Filesize
40KB

MD5
5f13dbc378792f23e598079fc1e4422b

SHA1
5813c05802f15930aa860b8363af2b58426c8adf

SHA256
6e87ecb7f62039fbb6e7676422d1a5e75a32b90dde6865dcb68ee658ba8df61d

SHA512
9270635a5294482f49e0292e26d45dd103b85fe27dc163d44531b095c5f9dbde6b904adaf1a888ba3c112a094380394713c796f5195b2566a20f00b42b6578e5

Download Submit