Analysis
-
max time kernel
120s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 20:01
Static task
static1
Behavioral task
behavioral1
Sample
6871273a8b73eaad109b5f7754c2bf87_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6871273a8b73eaad109b5f7754c2bf87_JaffaCakes118.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/ZipDLL.dll
Resource
win7-20240419-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/ZipDLL.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/etxtmwc.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/etxtmwc.dll
Resource
win10v2004-20240426-en
General
-
Target
6871273a8b73eaad109b5f7754c2bf87_JaffaCakes118.exe
-
Size
751KB
-
MD5
6871273a8b73eaad109b5f7754c2bf87
-
SHA1
47a620d098902000d036e72c1d72d8405943a8f2
-
SHA256
0686c6037915bacc6460ab3e21076eb5c6ae80b9964afc17aa4ef8fcbcd4bde7
-
SHA512
dc8f23d60796ea8b184bf18f15965cff04584f8b67a39c093d0e8257ffe7734bd5e71cd99761fddb762db9eaa006e6ad055f6f998c95484ba3b4f06fe59211ee
-
SSDEEP
12288:jPf8MvKvQ+iw9AuwjB/ugHbouCJvZTyAZX8nqFL7qvSS2MOgLmC97P+WyO2cfc8u:j38UKKw6djB/FUuCJvXbFavSS2+Lm6+/
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
bedgifdheb.exepid process 2896 bedgifdheb.exe -
Loads dropped DLL 11 IoCs
Processes:
6871273a8b73eaad109b5f7754c2bf87_JaffaCakes118.exeWerFault.exepid process 1500 6871273a8b73eaad109b5f7754c2bf87_JaffaCakes118.exe 1500 6871273a8b73eaad109b5f7754c2bf87_JaffaCakes118.exe 1500 6871273a8b73eaad109b5f7754c2bf87_JaffaCakes118.exe 1500 6871273a8b73eaad109b5f7754c2bf87_JaffaCakes118.exe 2380 WerFault.exe 2380 WerFault.exe 2380 WerFault.exe 2380 WerFault.exe 2380 WerFault.exe 2380 WerFault.exe 2380 WerFault.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2380 2896 WerFault.exe bedgifdheb.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
wmic.exewmic.exewmic.exedescription pid process Token: SeIncreaseQuotaPrivilege 2612 wmic.exe Token: SeSecurityPrivilege 2612 wmic.exe Token: SeTakeOwnershipPrivilege 2612 wmic.exe Token: SeLoadDriverPrivilege 2612 wmic.exe Token: SeSystemProfilePrivilege 2612 wmic.exe Token: SeSystemtimePrivilege 2612 wmic.exe Token: SeProfSingleProcessPrivilege 2612 wmic.exe Token: SeIncBasePriorityPrivilege 2612 wmic.exe Token: SeCreatePagefilePrivilege 2612 wmic.exe Token: SeBackupPrivilege 2612 wmic.exe Token: SeRestorePrivilege 2612 wmic.exe Token: SeShutdownPrivilege 2612 wmic.exe Token: SeDebugPrivilege 2612 wmic.exe Token: SeSystemEnvironmentPrivilege 2612 wmic.exe Token: SeRemoteShutdownPrivilege 2612 wmic.exe Token: SeUndockPrivilege 2612 wmic.exe Token: SeManageVolumePrivilege 2612 wmic.exe Token: 33 2612 wmic.exe Token: 34 2612 wmic.exe Token: 35 2612 wmic.exe Token: SeIncreaseQuotaPrivilege 2612 wmic.exe Token: SeSecurityPrivilege 2612 wmic.exe Token: SeTakeOwnershipPrivilege 2612 wmic.exe Token: SeLoadDriverPrivilege 2612 wmic.exe Token: SeSystemProfilePrivilege 2612 wmic.exe Token: SeSystemtimePrivilege 2612 wmic.exe Token: SeProfSingleProcessPrivilege 2612 wmic.exe Token: SeIncBasePriorityPrivilege 2612 wmic.exe Token: SeCreatePagefilePrivilege 2612 wmic.exe Token: SeBackupPrivilege 2612 wmic.exe Token: SeRestorePrivilege 2612 wmic.exe Token: SeShutdownPrivilege 2612 wmic.exe Token: SeDebugPrivilege 2612 wmic.exe Token: SeSystemEnvironmentPrivilege 2612 wmic.exe Token: SeRemoteShutdownPrivilege 2612 wmic.exe Token: SeUndockPrivilege 2612 wmic.exe Token: SeManageVolumePrivilege 2612 wmic.exe Token: 33 2612 wmic.exe Token: 34 2612 wmic.exe Token: 35 2612 wmic.exe Token: SeIncreaseQuotaPrivilege 2484 wmic.exe Token: SeSecurityPrivilege 2484 wmic.exe Token: SeTakeOwnershipPrivilege 2484 wmic.exe Token: SeLoadDriverPrivilege 2484 wmic.exe Token: SeSystemProfilePrivilege 2484 wmic.exe Token: SeSystemtimePrivilege 2484 wmic.exe Token: SeProfSingleProcessPrivilege 2484 wmic.exe Token: SeIncBasePriorityPrivilege 2484 wmic.exe Token: SeCreatePagefilePrivilege 2484 wmic.exe Token: SeBackupPrivilege 2484 wmic.exe Token: SeRestorePrivilege 2484 wmic.exe Token: SeShutdownPrivilege 2484 wmic.exe Token: SeDebugPrivilege 2484 wmic.exe Token: SeSystemEnvironmentPrivilege 2484 wmic.exe Token: SeRemoteShutdownPrivilege 2484 wmic.exe Token: SeUndockPrivilege 2484 wmic.exe Token: SeManageVolumePrivilege 2484 wmic.exe Token: 33 2484 wmic.exe Token: 34 2484 wmic.exe Token: 35 2484 wmic.exe Token: SeIncreaseQuotaPrivilege 2508 wmic.exe Token: SeSecurityPrivilege 2508 wmic.exe Token: SeTakeOwnershipPrivilege 2508 wmic.exe Token: SeLoadDriverPrivilege 2508 wmic.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
6871273a8b73eaad109b5f7754c2bf87_JaffaCakes118.exebedgifdheb.exedescription pid process target process PID 1500 wrote to memory of 2896 1500 6871273a8b73eaad109b5f7754c2bf87_JaffaCakes118.exe bedgifdheb.exe PID 1500 wrote to memory of 2896 1500 6871273a8b73eaad109b5f7754c2bf87_JaffaCakes118.exe bedgifdheb.exe PID 1500 wrote to memory of 2896 1500 6871273a8b73eaad109b5f7754c2bf87_JaffaCakes118.exe bedgifdheb.exe PID 1500 wrote to memory of 2896 1500 6871273a8b73eaad109b5f7754c2bf87_JaffaCakes118.exe bedgifdheb.exe PID 2896 wrote to memory of 2612 2896 bedgifdheb.exe wmic.exe PID 2896 wrote to memory of 2612 2896 bedgifdheb.exe wmic.exe PID 2896 wrote to memory of 2612 2896 bedgifdheb.exe wmic.exe PID 2896 wrote to memory of 2612 2896 bedgifdheb.exe wmic.exe PID 2896 wrote to memory of 2484 2896 bedgifdheb.exe wmic.exe PID 2896 wrote to memory of 2484 2896 bedgifdheb.exe wmic.exe PID 2896 wrote to memory of 2484 2896 bedgifdheb.exe wmic.exe PID 2896 wrote to memory of 2484 2896 bedgifdheb.exe wmic.exe PID 2896 wrote to memory of 2508 2896 bedgifdheb.exe wmic.exe PID 2896 wrote to memory of 2508 2896 bedgifdheb.exe wmic.exe PID 2896 wrote to memory of 2508 2896 bedgifdheb.exe wmic.exe PID 2896 wrote to memory of 2508 2896 bedgifdheb.exe wmic.exe PID 2896 wrote to memory of 2460 2896 bedgifdheb.exe wmic.exe PID 2896 wrote to memory of 2460 2896 bedgifdheb.exe wmic.exe PID 2896 wrote to memory of 2460 2896 bedgifdheb.exe wmic.exe PID 2896 wrote to memory of 2460 2896 bedgifdheb.exe wmic.exe PID 2896 wrote to memory of 2292 2896 bedgifdheb.exe wmic.exe PID 2896 wrote to memory of 2292 2896 bedgifdheb.exe wmic.exe PID 2896 wrote to memory of 2292 2896 bedgifdheb.exe wmic.exe PID 2896 wrote to memory of 2292 2896 bedgifdheb.exe wmic.exe PID 2896 wrote to memory of 2380 2896 bedgifdheb.exe WerFault.exe PID 2896 wrote to memory of 2380 2896 bedgifdheb.exe WerFault.exe PID 2896 wrote to memory of 2380 2896 bedgifdheb.exe WerFault.exe PID 2896 wrote to memory of 2380 2896 bedgifdheb.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6871273a8b73eaad109b5f7754c2bf87_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6871273a8b73eaad109b5f7754c2bf87_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bedgifdheb.exeC:\Users\Admin\AppData\Local\Temp\bedgifdheb.exe 1\5\7\4\9\9\8\5\3\8\6 LktCQDQoKy0zLRouTk4+R0A8OC0YKU1ATVNGSUNEQTUrHyo9RUpLQT86KTI4MikcJjpBPzooGi5LS0s7TDtPXEE+PCwxLSkwGCpQPUxVQEtbTElEOGVsbm81KCtqaW4pQT1NSihNS0ckOUtNJkNNQUgcJjpEREBDQ0M4GSs7KDUtLxgpQy02KSgXJz8wNScwGyhAKzQlLB0nPjQ4Ji0XJkhNTDxPQk9YTElATjxAUTcfKklORjtNPlFXP1RHOjkXJkhNTDxPQk9YSjhEPThlYW5sXGchKSdobWwdLC8uJzIcKShmYnFhZGkZKzxPPVpSSkY8GyhBTzxXPko8RkhJPjkXJkBKUExZQU1IU0o8SjguGClTQzpKQlBHUFxNTEs4GStNRDUtHSc+Uiw2HCZJTUlRQUdEWlBBQzpHSEJBR0BCPlFJQzUbLEFNXk1OSktARUA6bGx0YBkrSTxMUE9GQ01CWFFKPEpaQTlTUjgrHCY/QT9CUDcwGyhFSlY8VEs5R0g+WEFFOkpUTUw/QzhfXWNqXRssPElWSUVLODtXRE01KzgyJy0qLSYsMCwoMCsZK0c4SjxJRD9LWkJKSks5R0k1bnFwXhwmS0FIQjUrMy4vNC8oKDMwGClDSlBKQ0Y5P1xMQ0xANjMmKCwqLygrNCUqNiovMiswIkpM2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81716408115.txt bios get serialnumber3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81716408115.txt bios get version3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81716408115.txt bios get version3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81716408115.txt bios get version3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81716408115.txt bios get version3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 3723⤵
- Loads dropped DLL
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\81716408115.txtFilesize
66B
MD59025468f85256136f923096b01375964
SHA17fcd174999661594fa5f88890ffb195e9858cc52
SHA256d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df
SHA51292cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51
-
C:\Users\Admin\AppData\Local\Temp\nso88FF.tmp\etxtmwc.dllFilesize
158KB
MD54d3c8a633d0bba7bc5b9010a69303d4d
SHA146aab421789437fc7cb681655739aff5d7578d8d
SHA256034f6c733cc6d45d953b9c0df9c2110defa569873bd2f6f0be61332264174344
SHA5127e92b5aa8d25809936d61ba22f89215088a3e97ca29cbfd033d0594669a7bd245519e777f7505a8fa83a09db3b31646ea050e22fe16f98a3c7e4c0c8f5d93acf
-
\Users\Admin\AppData\Local\Temp\bedgifdheb.exeFilesize
1.2MB
MD58774e61c3804a39841203c215ee939fa
SHA1586f647babc4987734678fb382e17827d897f952
SHA25631adab2582951b5fd658c42b39905c85b5edb60b9d91f979c1e0816b04b1f955
SHA5123b496a2ab43aa01b5f555fd8b45932108a1c89686e0322c3d942e873f1134c29c94ddaddc713d333602b722ddc6cf7ac2c209ee454325f6fc4bdf46aacfceb28
-
\Users\Admin\AppData\Local\Temp\nso88FF.tmp\ZipDLL.dllFilesize
163KB
MD52dc35ddcabcb2b24919b9afae4ec3091
SHA19eeed33c3abc656353a7ebd1c66af38cccadd939
SHA2566bbeb39747f1526752980d4dbec2fe2c7347f3cc983a79c92561b92fe472e7a1
SHA5120ccac336924f684da1f73db2dd230a0c932c5b4115ae1fa0e708b9db5e39d2a07dc54dac8d95881a42069cbb2c2886e880cdad715deda83c0de38757a0f6a901