06eba827c5f714e838acefaa15b50f86549e03e429c65e65c95fdb994a608a25

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 23:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4d973a7002a91461fde21a0a32110f87_JaffaCakes118.exe
Size

763KB
MD5

4d973a7002a91461fde21a0a32110f87
SHA1

be8d693a3a396de81a38fe68c05035eeba75e796
SHA256

06eba827c5f714e838acefaa15b50f86549e03e429c65e65c95fdb994a608a25
SHA512

ce84b751dc473a78ab1123489811b122234a69a8f39710c04a77917c7e110e818912732a2390087850f3515a28373145188845fa959d2d21c89b6c4911f9acf6
SSDEEP

12288:JMco1N6ngGMzGDBtuazWXpGRie5shGXaPIWfgKmMKwwhrfX490p2:JM3TWtuK9B5MGqQWfrZfwhI

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2792	1432166534.exe

Loads dropped DLL 11 IoCs

pid	Process
1776	4d973a7002a91461fde21a0a32110f87_JaffaCakes118.exe
1776	4d973a7002a91461fde21a0a32110f87_JaffaCakes118.exe
1776	4d973a7002a91461fde21a0a32110f87_JaffaCakes118.exe
1776	4d973a7002a91461fde21a0a32110f87_JaffaCakes118.exe
2600	WerFault.exe
2600	WerFault.exe
2600	WerFault.exe
2600	WerFault.exe
2600	WerFault.exe
2600	WerFault.exe
2600	WerFault.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2600	2792	WerFault.exe	28

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2648	wmic.exe
Token: SeSecurityPrivilege	2648	wmic.exe
Token: SeTakeOwnershipPrivilege	2648	wmic.exe
Token: SeLoadDriverPrivilege	2648	wmic.exe
Token: SeSystemProfilePrivilege	2648	wmic.exe
Token: SeSystemtimePrivilege	2648	wmic.exe
Token: SeProfSingleProcessPrivilege	2648	wmic.exe
Token: SeIncBasePriorityPrivilege	2648	wmic.exe
Token: SeCreatePagefilePrivilege	2648	wmic.exe
Token: SeBackupPrivilege	2648	wmic.exe
Token: SeRestorePrivilege	2648	wmic.exe
Token: SeShutdownPrivilege	2648	wmic.exe
Token: SeDebugPrivilege	2648	wmic.exe
Token: SeSystemEnvironmentPrivilege	2648	wmic.exe
Token: SeRemoteShutdownPrivilege	2648	wmic.exe
Token: SeUndockPrivilege	2648	wmic.exe
Token: SeManageVolumePrivilege	2648	wmic.exe
Token: 33	2648	wmic.exe
Token: 34	2648	wmic.exe
Token: 35	2648	wmic.exe
Token: SeIncreaseQuotaPrivilege	2648	wmic.exe
Token: SeSecurityPrivilege	2648	wmic.exe
Token: SeTakeOwnershipPrivilege	2648	wmic.exe
Token: SeLoadDriverPrivilege	2648	wmic.exe
Token: SeSystemProfilePrivilege	2648	wmic.exe
Token: SeSystemtimePrivilege	2648	wmic.exe
Token: SeProfSingleProcessPrivilege	2648	wmic.exe
Token: SeIncBasePriorityPrivilege	2648	wmic.exe
Token: SeCreatePagefilePrivilege	2648	wmic.exe
Token: SeBackupPrivilege	2648	wmic.exe
Token: SeRestorePrivilege	2648	wmic.exe
Token: SeShutdownPrivilege	2648	wmic.exe
Token: SeDebugPrivilege	2648	wmic.exe
Token: SeSystemEnvironmentPrivilege	2648	wmic.exe
Token: SeRemoteShutdownPrivilege	2648	wmic.exe
Token: SeUndockPrivilege	2648	wmic.exe
Token: SeManageVolumePrivilege	2648	wmic.exe
Token: 33	2648	wmic.exe
Token: 34	2648	wmic.exe
Token: 35	2648	wmic.exe
Token: SeIncreaseQuotaPrivilege	2764	wmic.exe
Token: SeSecurityPrivilege	2764	wmic.exe
Token: SeTakeOwnershipPrivilege	2764	wmic.exe
Token: SeLoadDriverPrivilege	2764	wmic.exe
Token: SeSystemProfilePrivilege	2764	wmic.exe
Token: SeSystemtimePrivilege	2764	wmic.exe
Token: SeProfSingleProcessPrivilege	2764	wmic.exe
Token: SeIncBasePriorityPrivilege	2764	wmic.exe
Token: SeCreatePagefilePrivilege	2764	wmic.exe
Token: SeBackupPrivilege	2764	wmic.exe
Token: SeRestorePrivilege	2764	wmic.exe
Token: SeShutdownPrivilege	2764	wmic.exe
Token: SeDebugPrivilege	2764	wmic.exe
Token: SeSystemEnvironmentPrivilege	2764	wmic.exe
Token: SeRemoteShutdownPrivilege	2764	wmic.exe
Token: SeUndockPrivilege	2764	wmic.exe
Token: SeManageVolumePrivilege	2764	wmic.exe
Token: 33	2764	wmic.exe
Token: 34	2764	wmic.exe
Token: 35	2764	wmic.exe
Token: SeIncreaseQuotaPrivilege	2524	wmic.exe
Token: SeSecurityPrivilege	2524	wmic.exe
Token: SeTakeOwnershipPrivilege	2524	wmic.exe
Token: SeLoadDriverPrivilege	2524	wmic.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1776 wrote to memory of 2792	1776	4d973a7002a91461fde21a0a32110f87_JaffaCakes118.exe	28
PID 1776 wrote to memory of 2792	1776	4d973a7002a91461fde21a0a32110f87_JaffaCakes118.exe	28
PID 1776 wrote to memory of 2792	1776	4d973a7002a91461fde21a0a32110f87_JaffaCakes118.exe	28
PID 1776 wrote to memory of 2792	1776	4d973a7002a91461fde21a0a32110f87_JaffaCakes118.exe	28
PID 2792 wrote to memory of 2648	2792	1432166534.exe	29
PID 2792 wrote to memory of 2648	2792	1432166534.exe	29
PID 2792 wrote to memory of 2648	2792	1432166534.exe	29
PID 2792 wrote to memory of 2648	2792	1432166534.exe	29
PID 2792 wrote to memory of 2764	2792	1432166534.exe	32
PID 2792 wrote to memory of 2764	2792	1432166534.exe	32
PID 2792 wrote to memory of 2764	2792	1432166534.exe	32
PID 2792 wrote to memory of 2764	2792	1432166534.exe	32
PID 2792 wrote to memory of 2524	2792	1432166534.exe	34
PID 2792 wrote to memory of 2524	2792	1432166534.exe	34
PID 2792 wrote to memory of 2524	2792	1432166534.exe	34
PID 2792 wrote to memory of 2524	2792	1432166534.exe	34
PID 2792 wrote to memory of 2740	2792	1432166534.exe	36
PID 2792 wrote to memory of 2740	2792	1432166534.exe	36
PID 2792 wrote to memory of 2740	2792	1432166534.exe	36
PID 2792 wrote to memory of 2740	2792	1432166534.exe	36
PID 2792 wrote to memory of 2572	2792	1432166534.exe	38
PID 2792 wrote to memory of 2572	2792	1432166534.exe	38
PID 2792 wrote to memory of 2572	2792	1432166534.exe	38
PID 2792 wrote to memory of 2572	2792	1432166534.exe	38
PID 2792 wrote to memory of 2600	2792	1432166534.exe	40
PID 2792 wrote to memory of 2600	2792	1432166534.exe	40
PID 2792 wrote to memory of 2600	2792	1432166534.exe	40
PID 2792 wrote to memory of 2600	2792	1432166534.exe	40

C:\Users\Admin\AppData\Local\Temp\4d973a7002a91461fde21a0a32110f87_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4d973a7002a91461fde21a0a32110f87_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1776
- C:\Users\Admin\AppData\Local\Temp\1432166534.exe
  C:\Users\Admin\AppData\Local\Temp\1432166534.exe 5,9,6,6,7,8,5,4,7,0,9 KkdDPjYpMywxMhcqSk88SUE/OSkgJkk8TlFISkZFPT0oGyY+Q0xMREA2Mi4zMCsaKDtEQDYwFypHTEk9TT5QWEk7OCktLCovGytMRUlRPExZTkpHOWF0a2sxKSlsanEqPUVKRiROSUklPExJLkBJPUkaKDtHRTxLQD80Gik9KTgpKiAmPyk3JyoYKkAsPSQsFyk+LTUoLRkvOzA0JysZJ0tOSERMPktZSktBUT08WTQbJkpMSDxQP01fPFBDOzcZJ0tOSERMPktZSDpFQDlLb2xnXG5uXh0tLEx5am9cZx8rKCghKzBJamxmX21sYCErMEppYGpfax0tLCsuJxsmP1I+V1BORT1fb2tqNCgncnNwLmlqbGZfbWxgb2dpZ2BpKF1oZSpza3MmbWpZbV5scGwnZW9gFyk/UT1aP0ZEQ0RFPzcZJ0NLTFRWPUlJUUw9TTkrICZPPztIRFFKUVhVSUc0Ym5taDUrKHduciVuYlpmZm8nZVh1XGYoXGdoK2JuW2BvKGphaDpgZj1ucm4oXmhvaWhoYVtrY19yJ1tqaR9wYnI0PklQRkdLOkRHRzxSIGlfOE5odWNga25fHiorT3Jza2BkHywpJSAuKVJmcGNfbm1dIC4pU2VkZ19sHiorLicwHWpeN00+RyFwa2NiZFs3IFpeYWVdPR1mbjcgaWVfMTYmYGlqbltlZGBuNjkXKk1HNysYKkBMMTQ/RlFIRUcrLSlaKy1bMy0wLTMwLDUrYC4tYC9cYV0vZFkzWitgMlxhNS4gJk1MSE5CRUBbUEVDPkZHP0JFPEM+VUlHNBopQktaTk5OS0REPzdtanBhGS9JQEtPTEdBSUNYVUpASVk+OlFOOSsgJkNAPj9RNSwcKElKWjtTSDpFRD9YRUU+SVNKTT0/OV9hY25cGik9R1JKRU84P1ZDSjYxLioqODApKi0oKiguHChUQEg8NystKy0tMDQsKzAaKT1HUkpFTzg/Vk5DRj04MSgyKCopKisuIi02KjUxKzAkO0YYKlFMRUlaOEE/R0w4S250OW1mcW1eHS0sZmFlXF5fbB4qKyRfaWlgXWlyIhgqUTo9RGpxY2ZlWSAuXzUlKyIiUWJmX2twcyJJSyUwJykkJzpwZ2dcUV9bQ2RwHjJdMCoxKCwuJiRESEtIQx8sXCNnZWRlIkJcXWVoISY/YXJmaFwfLF8sLSopLikuKCsoKi0tJ0xhXVxpYx8rXjAvMC4qMRcpT0tEOGRtdGcgKlsfK14gLl9nXG9pKGBiZGA0XWVqZmtpaidbamkeMl1NbGhOYmVgQGh3ZWdmW15GWWldYGVpWltfamVndCErZigwKS0vKSkuNS0lKWE7aXFnZGpdXW1YaVhhX2sdLWJgZWsxLR8tX2ggL10xLysvLB8rLl8hLGQpMi8zKx4qMWgeM1stKiwrMB0tMmclKl8oHywvaG1rXXVab2VbZ14dLmA9b25pY2lbXSNIXWdhXmBpHywvXXNhbnJjICpeYm1sayEsYRwtXR8sX29ycydyZnBjX25tXW5qYnBcbSVdaWYdLWJwcmogKWBsbFduYW11Zylccl8eKjFgcm5YaGBdaFplYCEsZElqbGZfbWxgJ0x5am9cZyUmI01rbmxcb2tfJUxmZGxeciItJSofKy5OISxkO0pOSEZIKCwsUzQpXzAtMS4wLy8uNFwyKmAwXV5cMl1iL14oYDNdXjQxHjItcFgfLV1HcHA7cmZyal8lZllpXWBlaSYfYGNrXWFrcSkcLS1uc25qZyEsZF9va2ofLFkgLl8lKWFucXEnbGNdZ2tqKVxbdF5kKV9obRwtXWNoXV1zKmloZyAqYF5mHS5gcHduKVtpcWdkal1dcGNgbyhdaGUgLi9wYnIcLV49R1JKRU84P0dGP1EdLTJpZxwuW0xpbmRgcG1lHC0sLC8rKE51bHRcaBwsLystLSwmJSkwKS8sKUpqcWVla29cHywuKjAuKVNlZGdfbB4qMC4uMictJSofKy5qYx4zW048SR8rLm9uXGtgXxwtXh4qMV1fZmBfHC1eHioxZ3AlKl8cLDBpZV8xHjNbICkwY2drb11lbFxtHC1eMg==
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2792
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81715902859.txt bios get serialnumber
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2648
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81715902859.txt bios get version
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2764
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81715902859.txt bios get version
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2524
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81715902859.txt bios get version
    3⤵
    PID:2740
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81715902859.txt bios get version
    3⤵
    PID:2572
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2792 -s 368
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\81715902859.txt

Filesize
66B

MD5
9025468f85256136f923096b01375964

SHA1
7fcd174999661594fa5f88890ffb195e9858cc52

SHA256
d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df

SHA512
92cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51

Download Submit
\Users\Admin\AppData\Local\Temp\1432166534.exe

Filesize
1021KB

MD5
89e510df392f34e7a452db67a03838f1

SHA1
733b260a09aa886526663b81a9ec2a86efc5e76d

SHA256
e67841a3edafa7dd4bebe9b32d270b2f3ce888175889cbf112127494323a828c

SHA512
0ecc062532d91f4c0fe01541f3854167ed803e58a8d119aed537d7ba1506d19f582ffc73b02b4d4dfd3ad90176bf37a461711aca4ecdc48530e21e0ab1db76ce

Download Submit
\Users\Admin\AppData\Local\Temp\nsi164F.tmp\fhhuygp.dll

Filesize
158KB

MD5
03a381309693692c04812bc0fe9e0c61

SHA1
c83d2e54d7d38643445996c568bc13b4d3f7dd2b

SHA256
b9dd478d49f7c5ec668fdc3423b0f0931be4847b051d6c16d6a6684bcd2a3001

SHA512
52bfeb2bca5c5e3fc0e18ad1edbd79d4ddfe995456913d908c2eaec5174be97f998f3dd7cfc59747d47cfbaad0711655a2278d7dc6cf90240d437795137d2f91

Download Submit
\Users\Admin\AppData\Local\Temp\nsi164F.tmp\nsisunz.dll

Filesize
40KB

MD5
5f13dbc378792f23e598079fc1e4422b

SHA1
5813c05802f15930aa860b8363af2b58426c8adf

SHA256
6e87ecb7f62039fbb6e7676422d1a5e75a32b90dde6865dcb68ee658ba8df61d

SHA512
9270635a5294482f49e0292e26d45dd103b85fe27dc163d44531b095c5f9dbde6b904adaf1a888ba3c112a094380394713c796f5195b2566a20f00b42b6578e5

Download Submit