Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 01:21
Static task
static1
Behavioral task
behavioral1
Sample
6580c0371a34ebed37cefb25e9f7f551_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
6580c0371a34ebed37cefb25e9f7f551_JaffaCakes118.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
beeiffdhdh.exe
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
beeiffdhdh.exe
Resource
win10v2004-20240508-en
General
-
Target
6580c0371a34ebed37cefb25e9f7f551_JaffaCakes118.exe
-
Size
339KB
-
MD5
6580c0371a34ebed37cefb25e9f7f551
-
SHA1
03524790c4fad492c7913e9e68e840e44caff578
-
SHA256
3feab1975979185bae1f5a5895589c31d249c523d094c8bb039992684355c3d5
-
SHA512
964fbe550b856c3d586459eac86c92ae018d233da95a7cd4ba8d90e5bfdd8a809c50a276ea06b6c94f86c5b79a349625acd124c1ec5cfe52fc72db20aac7c7e5
-
SSDEEP
6144:XFJ0pstoI+fJxw3ZEbw4acxUvMJ39y2U0soduo:OstyTsf8xUEe2U0TIo
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
beeiffdhdh.exepid process 5032 beeiffdhdh.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 5036 5032 WerFault.exe beeiffdhdh.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
wmic.exewmic.exedescription pid process Token: SeIncreaseQuotaPrivilege 3696 wmic.exe Token: SeSecurityPrivilege 3696 wmic.exe Token: SeTakeOwnershipPrivilege 3696 wmic.exe Token: SeLoadDriverPrivilege 3696 wmic.exe Token: SeSystemProfilePrivilege 3696 wmic.exe Token: SeSystemtimePrivilege 3696 wmic.exe Token: SeProfSingleProcessPrivilege 3696 wmic.exe Token: SeIncBasePriorityPrivilege 3696 wmic.exe Token: SeCreatePagefilePrivilege 3696 wmic.exe Token: SeBackupPrivilege 3696 wmic.exe Token: SeRestorePrivilege 3696 wmic.exe Token: SeShutdownPrivilege 3696 wmic.exe Token: SeDebugPrivilege 3696 wmic.exe Token: SeSystemEnvironmentPrivilege 3696 wmic.exe Token: SeRemoteShutdownPrivilege 3696 wmic.exe Token: SeUndockPrivilege 3696 wmic.exe Token: SeManageVolumePrivilege 3696 wmic.exe Token: 33 3696 wmic.exe Token: 34 3696 wmic.exe Token: 35 3696 wmic.exe Token: 36 3696 wmic.exe Token: SeIncreaseQuotaPrivilege 3696 wmic.exe Token: SeSecurityPrivilege 3696 wmic.exe Token: SeTakeOwnershipPrivilege 3696 wmic.exe Token: SeLoadDriverPrivilege 3696 wmic.exe Token: SeSystemProfilePrivilege 3696 wmic.exe Token: SeSystemtimePrivilege 3696 wmic.exe Token: SeProfSingleProcessPrivilege 3696 wmic.exe Token: SeIncBasePriorityPrivilege 3696 wmic.exe Token: SeCreatePagefilePrivilege 3696 wmic.exe Token: SeBackupPrivilege 3696 wmic.exe Token: SeRestorePrivilege 3696 wmic.exe Token: SeShutdownPrivilege 3696 wmic.exe Token: SeDebugPrivilege 3696 wmic.exe Token: SeSystemEnvironmentPrivilege 3696 wmic.exe Token: SeRemoteShutdownPrivilege 3696 wmic.exe Token: SeUndockPrivilege 3696 wmic.exe Token: SeManageVolumePrivilege 3696 wmic.exe Token: 33 3696 wmic.exe Token: 34 3696 wmic.exe Token: 35 3696 wmic.exe Token: 36 3696 wmic.exe Token: SeIncreaseQuotaPrivilege 4244 wmic.exe Token: SeSecurityPrivilege 4244 wmic.exe Token: SeTakeOwnershipPrivilege 4244 wmic.exe Token: SeLoadDriverPrivilege 4244 wmic.exe Token: SeSystemProfilePrivilege 4244 wmic.exe Token: SeSystemtimePrivilege 4244 wmic.exe Token: SeProfSingleProcessPrivilege 4244 wmic.exe Token: SeIncBasePriorityPrivilege 4244 wmic.exe Token: SeCreatePagefilePrivilege 4244 wmic.exe Token: SeBackupPrivilege 4244 wmic.exe Token: SeRestorePrivilege 4244 wmic.exe Token: SeShutdownPrivilege 4244 wmic.exe Token: SeDebugPrivilege 4244 wmic.exe Token: SeSystemEnvironmentPrivilege 4244 wmic.exe Token: SeRemoteShutdownPrivilege 4244 wmic.exe Token: SeUndockPrivilege 4244 wmic.exe Token: SeManageVolumePrivilege 4244 wmic.exe Token: 33 4244 wmic.exe Token: 34 4244 wmic.exe Token: 35 4244 wmic.exe Token: 36 4244 wmic.exe Token: SeIncreaseQuotaPrivilege 4244 wmic.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
6580c0371a34ebed37cefb25e9f7f551_JaffaCakes118.exebeeiffdhdh.exedescription pid process target process PID 1452 wrote to memory of 5032 1452 6580c0371a34ebed37cefb25e9f7f551_JaffaCakes118.exe beeiffdhdh.exe PID 1452 wrote to memory of 5032 1452 6580c0371a34ebed37cefb25e9f7f551_JaffaCakes118.exe beeiffdhdh.exe PID 1452 wrote to memory of 5032 1452 6580c0371a34ebed37cefb25e9f7f551_JaffaCakes118.exe beeiffdhdh.exe PID 5032 wrote to memory of 3696 5032 beeiffdhdh.exe wmic.exe PID 5032 wrote to memory of 3696 5032 beeiffdhdh.exe wmic.exe PID 5032 wrote to memory of 3696 5032 beeiffdhdh.exe wmic.exe PID 5032 wrote to memory of 4244 5032 beeiffdhdh.exe wmic.exe PID 5032 wrote to memory of 4244 5032 beeiffdhdh.exe wmic.exe PID 5032 wrote to memory of 4244 5032 beeiffdhdh.exe wmic.exe PID 5032 wrote to memory of 1356 5032 beeiffdhdh.exe wmic.exe PID 5032 wrote to memory of 1356 5032 beeiffdhdh.exe wmic.exe PID 5032 wrote to memory of 1356 5032 beeiffdhdh.exe wmic.exe PID 5032 wrote to memory of 3188 5032 beeiffdhdh.exe wmic.exe PID 5032 wrote to memory of 3188 5032 beeiffdhdh.exe wmic.exe PID 5032 wrote to memory of 3188 5032 beeiffdhdh.exe wmic.exe PID 5032 wrote to memory of 1056 5032 beeiffdhdh.exe wmic.exe PID 5032 wrote to memory of 1056 5032 beeiffdhdh.exe wmic.exe PID 5032 wrote to memory of 1056 5032 beeiffdhdh.exe wmic.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6580c0371a34ebed37cefb25e9f7f551_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6580c0371a34ebed37cefb25e9f7f551_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\beeiffdhdh.exeC:\Users\Admin\AppData\Local\Temp\beeiffdhdh.exe 4|8|1|1|5|6|0|3|1|6|5 K0hIQzgsMzAxMRsrS1RBS0NEOi8aKko9U1ZKTEtGQzcsHCdDSE5OSUE8LDQzLi8fKj1JQTwqGytIUU4/T0NRXkM/OSo4LysqICxSP01SPVFeUExMOmdub2wyLi5ubHYrQz9ORyVTTksnQU1PKERKPk4fKj1MRkJFREA1N3dpW05iMHJNUFlzWGdgUmVEL2AuMC9EVUBnNVMrbVBOeXM9U08vNGpockx3dW1dZUNqXVVyP1ZRQE5MTUleM2AleFZrLkljal9DdUgvSGtbVWhBYDI9SFhEQT04cEN0SUVtbTRrc0FnTy1fQ1pjcWtgLVUfKT8tNSwwGylELzwnLBwnQzI4JzEdLj4vOSUwHyo+NTosKxsrSFFOP09DUV5KTUVOQEJUNyAsT0xKQE1CU1o/VUlANxsrSFFOP09DUV5IPEk9PCdHQ1ZCKD1qakxkT1xsdGZxaSAuKEBtX2xlXkFpXmFka2gbKUVVRFlQTkQ8I3ZPUkl8GipBUERePkdESUhIQDkYLkdKTVRcQUxKU0tEUTgvICxTQjxKQ1hOUFlVT0s3Y3BsbzkqKWFga2NeZyZgY2NpYy4taGBwJ3N0SnE4STU9RnVyblRLUVMzZ2lpNWU+c283MiN1W20tNSV1XGwyOiVwXG4rPDE0LDEjTz1PVDUlbDgiTEZVPyQ/Z21TYEphb3NjbWt0QG1fbGVeQWleYWRraBspVko8LBsrPFIwOCw5LzAaKk5NTVNER0VcVj9HP0dMRERHQURET01INR8uRE1fT1RIT0VFRDxvbHViHylNQUxUUUlDTkReT05BSl5DPFNTOjEaKkRBQ0RTNzEdLkNOWzxYTTxHSUBeP0k/SlhPTz9EOmVbZ29dHy4/SVdLS0k8QFdITzgsMDUtKywsJjgyKSsyLx8pSz1KQEtHP0xcSEhOUDlLSzhucnJkGipQQUxEOCs0MTcvMTEqODIbKURMVkhHSzlDXk9DTUI8KywrKjUuLSoxMikxNS0sOTQuJFBK2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81716340884.txt bios get serialnumber3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81716340884.txt bios get version3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81716340884.txt bios get version3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81716340884.txt bios get version3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81716340884.txt bios get version3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 9563⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5032 -ip 50321⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\81716340884.txtFilesize
66B
MD59025468f85256136f923096b01375964
SHA17fcd174999661594fa5f88890ffb195e9858cc52
SHA256d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df
SHA51292cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51
-
C:\Users\Admin\AppData\Local\Temp\81716340884.txtFilesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
C:\Users\Admin\AppData\Local\Temp\81716340884.txtFilesize
58B
MD5f8e2f71e123c5a848f2a83d2a7aef11e
SHA15e7a9a2937fa4f06fdf3e33d7def7de431c159b4
SHA25679dae8edfddb5a748fb1ed83c87081b245aeff9178c95dcf5fbaaed6baf82121
SHA5128d34a80d335ee5be5d899b19b385aeaeb6bc5480fd72d3d9e96269da2f544ccc13b30fd23111980de736a612b8beb24ff062f6bed2eb2d252dbe07a2ffeb701e
-
C:\Users\Admin\AppData\Local\Temp\beeiffdhdh.exeFilesize
538KB
MD5c50bdf61ab68976774e9726190c8f495
SHA124ce506a98047760c959fdbbee800a97faff6ce4
SHA2568e32f667c333e0019b771d17a622dfa4107103db20acebf17742d8742fdad9e7
SHA512e91be4e6cb198e163b96aaec4cbd5fa28c76c69d520d8c0539d2643ae9f384cc1cb689b66bc22bb74ac46887a2d295f9210e085e07a13cd7509532c077a02b06