bf97dfd089a022fec6dc0974d476d21d532230745649d6c14efb93c15fad0d05

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21/05/2024, 15:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63d7a63a0777fc5201cf261b5c2b3ceb_JaffaCakes118.exe
Size

370KB
MD5

63d7a63a0777fc5201cf261b5c2b3ceb
SHA1

db1d1fc1c920be00ed306209f2d82096ef61f846
SHA256

bf97dfd089a022fec6dc0974d476d21d532230745649d6c14efb93c15fad0d05
SHA512

0b0890f29a0b97541170ee5f11ce180f114207ce4ee9a928136eee0488fc3b864b71cb788a3644d9cdaf57696aee716b05dfcd1a9fa34290bcfc4b0899f3c9d7
SSDEEP

6144:OFJ0F9YQWEkxTIenhOOiAKqtaH2X4Y7mRKIJif/xgk+0/:nqZEQs6PiataHoC5AfJg+

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1116	beejfhjgid.exe

Loads dropped DLL 5 IoCs

pid	Process
2032	63d7a63a0777fc5201cf261b5c2b3ceb_JaffaCakes118.exe
2380	WerFault.exe
2380	WerFault.exe
2380	WerFault.exe
2380	WerFault.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2380	1116	WerFault.exe	28

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1056	wmic.exe
Token: SeSecurityPrivilege	1056	wmic.exe
Token: SeTakeOwnershipPrivilege	1056	wmic.exe
Token: SeLoadDriverPrivilege	1056	wmic.exe
Token: SeSystemProfilePrivilege	1056	wmic.exe
Token: SeSystemtimePrivilege	1056	wmic.exe
Token: SeProfSingleProcessPrivilege	1056	wmic.exe
Token: SeIncBasePriorityPrivilege	1056	wmic.exe
Token: SeCreatePagefilePrivilege	1056	wmic.exe
Token: SeBackupPrivilege	1056	wmic.exe
Token: SeRestorePrivilege	1056	wmic.exe
Token: SeShutdownPrivilege	1056	wmic.exe
Token: SeDebugPrivilege	1056	wmic.exe
Token: SeSystemEnvironmentPrivilege	1056	wmic.exe
Token: SeRemoteShutdownPrivilege	1056	wmic.exe
Token: SeUndockPrivilege	1056	wmic.exe
Token: SeManageVolumePrivilege	1056	wmic.exe
Token: 33	1056	wmic.exe
Token: 34	1056	wmic.exe
Token: 35	1056	wmic.exe
Token: SeIncreaseQuotaPrivilege	1056	wmic.exe
Token: SeSecurityPrivilege	1056	wmic.exe
Token: SeTakeOwnershipPrivilege	1056	wmic.exe
Token: SeLoadDriverPrivilege	1056	wmic.exe
Token: SeSystemProfilePrivilege	1056	wmic.exe
Token: SeSystemtimePrivilege	1056	wmic.exe
Token: SeProfSingleProcessPrivilege	1056	wmic.exe
Token: SeIncBasePriorityPrivilege	1056	wmic.exe
Token: SeCreatePagefilePrivilege	1056	wmic.exe
Token: SeBackupPrivilege	1056	wmic.exe
Token: SeRestorePrivilege	1056	wmic.exe
Token: SeShutdownPrivilege	1056	wmic.exe
Token: SeDebugPrivilege	1056	wmic.exe
Token: SeSystemEnvironmentPrivilege	1056	wmic.exe
Token: SeRemoteShutdownPrivilege	1056	wmic.exe
Token: SeUndockPrivilege	1056	wmic.exe
Token: SeManageVolumePrivilege	1056	wmic.exe
Token: 33	1056	wmic.exe
Token: 34	1056	wmic.exe
Token: 35	1056	wmic.exe
Token: SeIncreaseQuotaPrivilege	2588	wmic.exe
Token: SeSecurityPrivilege	2588	wmic.exe
Token: SeTakeOwnershipPrivilege	2588	wmic.exe
Token: SeLoadDriverPrivilege	2588	wmic.exe
Token: SeSystemProfilePrivilege	2588	wmic.exe
Token: SeSystemtimePrivilege	2588	wmic.exe
Token: SeProfSingleProcessPrivilege	2588	wmic.exe
Token: SeIncBasePriorityPrivilege	2588	wmic.exe
Token: SeCreatePagefilePrivilege	2588	wmic.exe
Token: SeBackupPrivilege	2588	wmic.exe
Token: SeRestorePrivilege	2588	wmic.exe
Token: SeShutdownPrivilege	2588	wmic.exe
Token: SeDebugPrivilege	2588	wmic.exe
Token: SeSystemEnvironmentPrivilege	2588	wmic.exe
Token: SeRemoteShutdownPrivilege	2588	wmic.exe
Token: SeUndockPrivilege	2588	wmic.exe
Token: SeManageVolumePrivilege	2588	wmic.exe
Token: 33	2588	wmic.exe
Token: 34	2588	wmic.exe
Token: 35	2588	wmic.exe
Token: SeIncreaseQuotaPrivilege	2480	wmic.exe
Token: SeSecurityPrivilege	2480	wmic.exe
Token: SeTakeOwnershipPrivilege	2480	wmic.exe
Token: SeLoadDriverPrivilege	2480	wmic.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1116	2032	63d7a63a0777fc5201cf261b5c2b3ceb_JaffaCakes118.exe	28
PID 2032 wrote to memory of 1116	2032	63d7a63a0777fc5201cf261b5c2b3ceb_JaffaCakes118.exe	28
PID 2032 wrote to memory of 1116	2032	63d7a63a0777fc5201cf261b5c2b3ceb_JaffaCakes118.exe	28
PID 2032 wrote to memory of 1116	2032	63d7a63a0777fc5201cf261b5c2b3ceb_JaffaCakes118.exe	28
PID 1116 wrote to memory of 1056	1116	beejfhjgid.exe	29
PID 1116 wrote to memory of 1056	1116	beejfhjgid.exe	29
PID 1116 wrote to memory of 1056	1116	beejfhjgid.exe	29
PID 1116 wrote to memory of 1056	1116	beejfhjgid.exe	29
PID 1116 wrote to memory of 2588	1116	beejfhjgid.exe	32
PID 1116 wrote to memory of 2588	1116	beejfhjgid.exe	32
PID 1116 wrote to memory of 2588	1116	beejfhjgid.exe	32
PID 1116 wrote to memory of 2588	1116	beejfhjgid.exe	32
PID 1116 wrote to memory of 2480	1116	beejfhjgid.exe	34
PID 1116 wrote to memory of 2480	1116	beejfhjgid.exe	34
PID 1116 wrote to memory of 2480	1116	beejfhjgid.exe	34
PID 1116 wrote to memory of 2480	1116	beejfhjgid.exe	34
PID 1116 wrote to memory of 3028	1116	beejfhjgid.exe	36
PID 1116 wrote to memory of 3028	1116	beejfhjgid.exe	36
PID 1116 wrote to memory of 3028	1116	beejfhjgid.exe	36
PID 1116 wrote to memory of 3028	1116	beejfhjgid.exe	36
PID 1116 wrote to memory of 2400	1116	beejfhjgid.exe	38
PID 1116 wrote to memory of 2400	1116	beejfhjgid.exe	38
PID 1116 wrote to memory of 2400	1116	beejfhjgid.exe	38
PID 1116 wrote to memory of 2400	1116	beejfhjgid.exe	38
PID 1116 wrote to memory of 2380	1116	beejfhjgid.exe	40
PID 1116 wrote to memory of 2380	1116	beejfhjgid.exe	40
PID 1116 wrote to memory of 2380	1116	beejfhjgid.exe	40
PID 1116 wrote to memory of 2380	1116	beejfhjgid.exe	40

C:\Users\Admin\AppData\Local\Temp\63d7a63a0777fc5201cf261b5c2b3ceb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\63d7a63a0777fc5201cf261b5c2b3ceb_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Users\Admin\AppData\Local\Temp\beejfhjgid.exe
  C:\Users\Admin\AppData\Local\Temp\beejfhjgid.exe 1*6*7*3*5*2*5*0*9*9*3 LkpCQTgvNDgrKR0uTU4/S0c/PScXLE0/TVRKUEZJOzQuHyk9Rk5SREQ0KTY1Li0dKkFERDQnHS5KS0w/Uz5UVkBBPCwxNTQ2Gy9KPE9VP0tcUFBHPV9rcW80KCxucHEuOzxQSidNTEsrPFBHJUZNQEgdKkFHSTpCRkM3GSw/LzgtKBcsQyw2KiweKkQqNCowGihBLzsoMRcmQTQ3Ji4bLUtSRjtSQk5YTU1HUUE6UDofKUlPSkJQQ0tWQlRGOjobLUtSRjtSQk5YSzxLQD1cb2IfKT5VQF1QUkM0HS4/UUJaQUhEQ0BLRDcZLENNTlRWOU9OUUxCTTswICZLRUBIRFZKU1pVSUM6HylPSjgwGy87Si48GihPUExPSUQ8XFY/RUBKS0BJRDhERE9LSTgeKklKVk9USE1GSEM4dGlsYh8pS0JPU01OQEVEXk9MQk1dP0FQSjoxGihFREJAWDQoHS5DTFw/V0lBREBAXj9HQE1XS1Q8OzplW2VwYB4qREZOS0tJOkFaR0s9KSc1LSsqLSk3Li4oKS8fKUk+TT9HTDxDXEhITFE8Skc9a2lyZBooUURLQD0oKzE4MCsyMDYsICY7TFZIRUw8QlpUQERCPCsrLDQtLTAoLCcwNC0zNTAsKjhE
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1116
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81716306489.txt bios get serialnumber
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1056
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81716306489.txt bios get version
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2588
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81716306489.txt bios get version
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2480
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81716306489.txt bios get version
    3⤵
    PID:3028
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81716306489.txt bios get version
    3⤵
    PID:2400
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1116 -s 372
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\81716306489.txt

Filesize
66B

MD5
9025468f85256136f923096b01375964

SHA1
7fcd174999661594fa5f88890ffb195e9858cc52

SHA256
d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df

SHA512
92cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51

Download Submit
\Users\Admin\AppData\Local\Temp\beejfhjgid.exe

Filesize
631KB

MD5
605a146d0b79aec9c8739be5703bbbf8

SHA1
556173568cc050bec18cc5e8c52cdf777550a56c

SHA256
651ecc6261255cd3a4dbaf79bffd9663b23f4f8b1f91a1b99c72407023dc3ce4

SHA512
ac8021e5e0e623fc0219e23ee35136bf43f439781431ce53533c1339f738b70b14109f50f883a7f1dcc27e28b37deb24313ee07bb0073ce861fd806788f395d9

Download Submit