Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    16/05/2024, 10:28

General

  • Target

    4aa14fd0c9c99cdc9bb281fa59a02482_JaffaCakes118.exe

  • Size

    569KB

  • MD5

    4aa14fd0c9c99cdc9bb281fa59a02482

  • SHA1

    f94bb23e8c15e2d151d8349b939da5be605a90b7

  • SHA256

    068f31a65bad4ae7ca0718897189753c5ec8ac15af29cc0fdd43e8f4b6ed6ba1

  • SHA512

    78de1c81dde300d947ce3e4e22ca29558d679dfabaeb4384bcafe13cf39161431e1a9ec8d8469f7658e7075d483f4784c1fbe47456de2758fc45c521bff3c105

  • SSDEEP

    12288:TFzF90g8TfWKzjfQADweTzc7GxVVoXCw064eNdsXDbyaN:TdF938TfWKnfNxTzc7kVV0n4hyI

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 10 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4aa14fd0c9c99cdc9bb281fa59a02482_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\4aa14fd0c9c99cdc9bb281fa59a02482_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1276
    • C:\Users\Admin\AppData\Local\Temp\bgcabfebgi.exe
      C:\Users\Admin\AppData\Local\Temp\bgcabfebgi.exe 5-8-7-5-1-5-6-6-9-8-4 KkhCPzwsLSooKxwqS049T0Q+NycYK0k9TVJOTUVDOzUsGyc9RFJPQz40KjAxMTIbLj5DPjQoHCpIS0pDUD1OVkFAOCotKzMuGilKPU5RPUtaVE1GN19scGsyKCpyYGxwJWxkYCVaa28oXltrWSpkZl9qHyo9RkA7R0Q8Ni8zKzAwKis1KFovMTEoLiowKildLVtcLF9cXileXl5cXDAzLBopOyk5LBgoPzE4JysXJ0AuNSYsHyo+LjQlLRsnPTA8KCsaJkhOSjxOPlNaSkxATj0+UTYbLktMSTtNP09XPlBLPDcaJkhOSjxOPlNaSDtEPTkbJz5TRFpPTEM1HCo9UUBePkc+Q0FKQDUZKkdKTU5WOk5KT0xAUTgsGiZMRDxGRFROUFlPSUQ5GydPSDwtGik7Sy04ZVtuLGEuKhcnTlBGTURMQFlRPEQ/SkU+REw8QT9MSkg4GChEUlpMT0VMRUg9Nm9xcF8aJkpBT01LSUhJQVlMS0FNVz08WE43LBcnREQ8PlM8LBopQEtbP1FHPExEPVk8Rj9NUUlPRD83YFhkb2AYKD9OUkhGRjlAWkFJODU0KCslKjIpKSwyHypOQ0Q9OSwsKys0LC0vKSwcKjxIUk1HSTs7V1BERT44MCowKSkoLTAiLDUvMDQsKyI9SA==
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2996
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81715855338.txt bios get serialnumber
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2200
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81715855338.txt bios get version
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2748
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81715855338.txt bios get version
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2636
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81715855338.txt bios get version
        3⤵
          PID:2480
        • C:\Windows\SysWOW64\Wbem\wmic.exe
          wmic /output:C:\Users\Admin\AppData\Local\Temp\81715855338.txt bios get version
          3⤵
            PID:2360
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2996 -s 368
            3⤵
            • Loads dropped DLL
            • Program crash
            PID:1808

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\81715855338.txt

        Filesize

        66B

        MD5

        9025468f85256136f923096b01375964

        SHA1

        7fcd174999661594fa5f88890ffb195e9858cc52

        SHA256

        d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df

        SHA512

        92cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51

      • \Users\Admin\AppData\Local\Temp\bgcabfebgi.exe

        Filesize

        826KB

        MD5

        e0cd47d8b14d4fba7677b006111ae3cb

        SHA1

        80e865e3f64246a3b193cfc052fb26982e2aeed0

        SHA256

        a19e344f635a06f9d459da9cb739bd7f042128a3e0a3b57deaef74483ec119b3

        SHA512

        cf5c2dcd0dd8504786d8e0e0b3768ddae7f8776ad9edf16a35dfdd8fef287d80af22994f2c237013f0083b8ad3d531fcb8a46f066b2bef5f364172a7800ef208

      • \Users\Admin\AppData\Local\Temp\nstE54.tmp\kkss.dll

        Filesize

        108KB

        MD5

        e061a371413b7c7f73b469271ea6254a

        SHA1

        f3f027961dc7a923a431d7432c7096775aa1ab24

        SHA256

        7f721c31c87e0aa58ef48e14e582edcefeedfb8675742b67c9f2fd6a39b0f708

        SHA512

        6d9e42cd6569dc6d11391a8356582b5e87d84558c9be07fb01a9060ef6317de50fae2e74604dc82499f2878864ae8e02b3cc328f115bf3af2c2f4e8dc7e6fe48

      • \Users\Admin\AppData\Local\Temp\nstE54.tmp\nsisunz.dll

        Filesize

        40KB

        MD5

        5f13dbc378792f23e598079fc1e4422b

        SHA1

        5813c05802f15930aa860b8363af2b58426c8adf

        SHA256

        6e87ecb7f62039fbb6e7676422d1a5e75a32b90dde6865dcb68ee658ba8df61d

        SHA512

        9270635a5294482f49e0292e26d45dd103b85fe27dc163d44531b095c5f9dbde6b904adaf1a888ba3c112a094380394713c796f5195b2566a20f00b42b6578e5