Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 23:54
Static task
static1
Behavioral task
behavioral1
Sample
6910385abc5b5a0ecb085b0865f7d21e_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
6910385abc5b5a0ecb085b0865f7d21e_JaffaCakes118.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/ZipDLL.dll
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/ZipDLL.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/kcaomoc.dll
Resource
win7-20240215-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/kcaomoc.dll
Resource
win10v2004-20240426-en
General
-
Target
6910385abc5b5a0ecb085b0865f7d21e_JaffaCakes118.exe
-
Size
685KB
-
MD5
6910385abc5b5a0ecb085b0865f7d21e
-
SHA1
f41efa66167506f42a51a8e716a4ca3b5e23a5a7
-
SHA256
147e182026e208d0200b4d58472859666bdac7264487bd5ee58822805590895e
-
SHA512
0592608ea5752a59875f012ab33be373ed918b49b19af90b9b3213d262f2e02cd589c8ab35313bac461a8cee62747480c964ba66555da462b448bda063c65572
-
SSDEEP
12288:i/m6gr8mntY7dCDeo5T456Vh10IgD5mV0LHvwe8VpoGwk4fc8vy4hm0:i/DyZqRue84AVhZVYR8Vzn86P0
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
bedfiddeci.exepid process 2240 bedfiddeci.exe -
Loads dropped DLL 11 IoCs
Processes:
6910385abc5b5a0ecb085b0865f7d21e_JaffaCakes118.exeWerFault.exepid process 2176 6910385abc5b5a0ecb085b0865f7d21e_JaffaCakes118.exe 2176 6910385abc5b5a0ecb085b0865f7d21e_JaffaCakes118.exe 2176 6910385abc5b5a0ecb085b0865f7d21e_JaffaCakes118.exe 2176 6910385abc5b5a0ecb085b0865f7d21e_JaffaCakes118.exe 3044 WerFault.exe 3044 WerFault.exe 3044 WerFault.exe 3044 WerFault.exe 3044 WerFault.exe 3044 WerFault.exe 3044 WerFault.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3044 2240 WerFault.exe bedfiddeci.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
wmic.exewmic.exewmic.exedescription pid process Token: SeIncreaseQuotaPrivilege 2660 wmic.exe Token: SeSecurityPrivilege 2660 wmic.exe Token: SeTakeOwnershipPrivilege 2660 wmic.exe Token: SeLoadDriverPrivilege 2660 wmic.exe Token: SeSystemProfilePrivilege 2660 wmic.exe Token: SeSystemtimePrivilege 2660 wmic.exe Token: SeProfSingleProcessPrivilege 2660 wmic.exe Token: SeIncBasePriorityPrivilege 2660 wmic.exe Token: SeCreatePagefilePrivilege 2660 wmic.exe Token: SeBackupPrivilege 2660 wmic.exe Token: SeRestorePrivilege 2660 wmic.exe Token: SeShutdownPrivilege 2660 wmic.exe Token: SeDebugPrivilege 2660 wmic.exe Token: SeSystemEnvironmentPrivilege 2660 wmic.exe Token: SeRemoteShutdownPrivilege 2660 wmic.exe Token: SeUndockPrivilege 2660 wmic.exe Token: SeManageVolumePrivilege 2660 wmic.exe Token: 33 2660 wmic.exe Token: 34 2660 wmic.exe Token: 35 2660 wmic.exe Token: SeIncreaseQuotaPrivilege 2660 wmic.exe Token: SeSecurityPrivilege 2660 wmic.exe Token: SeTakeOwnershipPrivilege 2660 wmic.exe Token: SeLoadDriverPrivilege 2660 wmic.exe Token: SeSystemProfilePrivilege 2660 wmic.exe Token: SeSystemtimePrivilege 2660 wmic.exe Token: SeProfSingleProcessPrivilege 2660 wmic.exe Token: SeIncBasePriorityPrivilege 2660 wmic.exe Token: SeCreatePagefilePrivilege 2660 wmic.exe Token: SeBackupPrivilege 2660 wmic.exe Token: SeRestorePrivilege 2660 wmic.exe Token: SeShutdownPrivilege 2660 wmic.exe Token: SeDebugPrivilege 2660 wmic.exe Token: SeSystemEnvironmentPrivilege 2660 wmic.exe Token: SeRemoteShutdownPrivilege 2660 wmic.exe Token: SeUndockPrivilege 2660 wmic.exe Token: SeManageVolumePrivilege 2660 wmic.exe Token: 33 2660 wmic.exe Token: 34 2660 wmic.exe Token: 35 2660 wmic.exe Token: SeIncreaseQuotaPrivilege 2808 wmic.exe Token: SeSecurityPrivilege 2808 wmic.exe Token: SeTakeOwnershipPrivilege 2808 wmic.exe Token: SeLoadDriverPrivilege 2808 wmic.exe Token: SeSystemProfilePrivilege 2808 wmic.exe Token: SeSystemtimePrivilege 2808 wmic.exe Token: SeProfSingleProcessPrivilege 2808 wmic.exe Token: SeIncBasePriorityPrivilege 2808 wmic.exe Token: SeCreatePagefilePrivilege 2808 wmic.exe Token: SeBackupPrivilege 2808 wmic.exe Token: SeRestorePrivilege 2808 wmic.exe Token: SeShutdownPrivilege 2808 wmic.exe Token: SeDebugPrivilege 2808 wmic.exe Token: SeSystemEnvironmentPrivilege 2808 wmic.exe Token: SeRemoteShutdownPrivilege 2808 wmic.exe Token: SeUndockPrivilege 2808 wmic.exe Token: SeManageVolumePrivilege 2808 wmic.exe Token: 33 2808 wmic.exe Token: 34 2808 wmic.exe Token: 35 2808 wmic.exe Token: SeIncreaseQuotaPrivilege 2708 wmic.exe Token: SeSecurityPrivilege 2708 wmic.exe Token: SeTakeOwnershipPrivilege 2708 wmic.exe Token: SeLoadDriverPrivilege 2708 wmic.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
6910385abc5b5a0ecb085b0865f7d21e_JaffaCakes118.exebedfiddeci.exedescription pid process target process PID 2176 wrote to memory of 2240 2176 6910385abc5b5a0ecb085b0865f7d21e_JaffaCakes118.exe bedfiddeci.exe PID 2176 wrote to memory of 2240 2176 6910385abc5b5a0ecb085b0865f7d21e_JaffaCakes118.exe bedfiddeci.exe PID 2176 wrote to memory of 2240 2176 6910385abc5b5a0ecb085b0865f7d21e_JaffaCakes118.exe bedfiddeci.exe PID 2176 wrote to memory of 2240 2176 6910385abc5b5a0ecb085b0865f7d21e_JaffaCakes118.exe bedfiddeci.exe PID 2240 wrote to memory of 2660 2240 bedfiddeci.exe wmic.exe PID 2240 wrote to memory of 2660 2240 bedfiddeci.exe wmic.exe PID 2240 wrote to memory of 2660 2240 bedfiddeci.exe wmic.exe PID 2240 wrote to memory of 2660 2240 bedfiddeci.exe wmic.exe PID 2240 wrote to memory of 2808 2240 bedfiddeci.exe wmic.exe PID 2240 wrote to memory of 2808 2240 bedfiddeci.exe wmic.exe PID 2240 wrote to memory of 2808 2240 bedfiddeci.exe wmic.exe PID 2240 wrote to memory of 2808 2240 bedfiddeci.exe wmic.exe PID 2240 wrote to memory of 2708 2240 bedfiddeci.exe wmic.exe PID 2240 wrote to memory of 2708 2240 bedfiddeci.exe wmic.exe PID 2240 wrote to memory of 2708 2240 bedfiddeci.exe wmic.exe PID 2240 wrote to memory of 2708 2240 bedfiddeci.exe wmic.exe PID 2240 wrote to memory of 2772 2240 bedfiddeci.exe wmic.exe PID 2240 wrote to memory of 2772 2240 bedfiddeci.exe wmic.exe PID 2240 wrote to memory of 2772 2240 bedfiddeci.exe wmic.exe PID 2240 wrote to memory of 2772 2240 bedfiddeci.exe wmic.exe PID 2240 wrote to memory of 2592 2240 bedfiddeci.exe wmic.exe PID 2240 wrote to memory of 2592 2240 bedfiddeci.exe wmic.exe PID 2240 wrote to memory of 2592 2240 bedfiddeci.exe wmic.exe PID 2240 wrote to memory of 2592 2240 bedfiddeci.exe wmic.exe PID 2240 wrote to memory of 3044 2240 bedfiddeci.exe WerFault.exe PID 2240 wrote to memory of 3044 2240 bedfiddeci.exe WerFault.exe PID 2240 wrote to memory of 3044 2240 bedfiddeci.exe WerFault.exe PID 2240 wrote to memory of 3044 2240 bedfiddeci.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6910385abc5b5a0ecb085b0865f7d21e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6910385abc5b5a0ecb085b0865f7d21e_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bedfiddeci.exeC:\Users\Admin\AppData\Local\Temp\bedfiddeci.exe 6!0!2!9!8!3!1!6!0!9!4 KVBHOzU2MC45FytNVUBHQUE8KiAmSj9UVUZKSEg+PSgcKURHSkxGQzcyLC0uOR4mO0ZDNzAXK0pSTTtNQFNZSTs5LDQxKjEdLk1FSVI/Ul1MSkk8YnRrbDQvLWpqcy0+RUpHJ1RNRyU+T0ouQEpATx4mO0lIPUtAQDcgLTspOiwrICZALD0rKBgsQy09JC0aL0IrNSowGi87MTctLxcnTVFJREw/Tl9OSUFTQD1ZNBwpUFBGPFJCTl88UUZBOxcnTVFJREw/Tl9MOEVCPDxlY2hfJ3ElOmJgb3RwKjxvc2thbnRfICZBUkVdTEpJPBovPFQ/X0FEPElISEU0HClITUpMXEFMT05PP1I7KRgsU0JBRUdTT1NWTU9LNyAmUkc9MBcnQVIrPRcrTFVMS0FKRFlXPEg9T0s8QUpAQUVMTkY9HiZBUF5MVUVQQ01DNGxvdF8gJk4/VFNJRkZNQV9MTz9SXTs5VlI3MhcrQklCPFA6MBovQE9ZRFdFOUpIPV88Sj1SV0dMQkM3ZlhobWUeJjxMVkhMRj0+X0dHNTYwKDEpLSg4MSUpLjcaL0c9TEFKQz1JXkNOSlA7TEo0Xl5rbWUXK05JSzw1LjMtNS8xMTMxLRgsQ0lXRUhJQUJWTEZMPz0uKywvMCcpMikvOigxNDM0IUhK2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81716422082.txt bios get serialnumber3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81716422082.txt bios get version3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81716422082.txt bios get version3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81716422082.txt bios get version3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81716422082.txt bios get version3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2240 -s 3683⤵
- Loads dropped DLL
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\81716422082.txtFilesize
66B
MD59025468f85256136f923096b01375964
SHA17fcd174999661594fa5f88890ffb195e9858cc52
SHA256d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df
SHA51292cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51
-
\Users\Admin\AppData\Local\Temp\bedfiddeci.exeFilesize
906KB
MD5862c1090f95b776f4ce221fad19896a1
SHA1592928a040e3a22f00e657b7a5083a802d637a42
SHA256f70906e78d3980a49fc2672b931b93cb5be4031b0aad27434aac98aaba915cd9
SHA512248ab0fcbb31e389d348142b3d76c2e9517c6afefbc2b475cf0a6bb8b19b728f160dd1a32a389992eb5c831c4449c2268d4e11159925b9e4ffc6021582cfe48a
-
\Users\Admin\AppData\Local\Temp\nso197B.tmp\ZipDLL.dllFilesize
163KB
MD52dc35ddcabcb2b24919b9afae4ec3091
SHA19eeed33c3abc656353a7ebd1c66af38cccadd939
SHA2566bbeb39747f1526752980d4dbec2fe2c7347f3cc983a79c92561b92fe472e7a1
SHA5120ccac336924f684da1f73db2dd230a0c932c5b4115ae1fa0e708b9db5e39d2a07dc54dac8d95881a42069cbb2c2886e880cdad715deda83c0de38757a0f6a901
-
\Users\Admin\AppData\Local\Temp\nso197B.tmp\kcaomoc.dllFilesize
161KB
MD514034a1337df8a2f06625046305d115e
SHA19ad015babecda4058e57ec14523e50876e421ff5
SHA2567d8c368a43a48db3907cd13ba82aabd6bc1fd8f857d693f0147cd3fd68333778
SHA512f801980272dd2c5fdc5d45351ce29e3af14d292227308cbb8033a6cb7bfc8db60a1676fe09c17cb172396db1dae0c5e5d043fd0861dd36ff383b2ea1cc00f880