Analysis
-
max time kernel
140s -
max time network
111s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 20:01
Static task
static1
Behavioral task
behavioral1
Sample
6871273a8b73eaad109b5f7754c2bf87_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6871273a8b73eaad109b5f7754c2bf87_JaffaCakes118.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/ZipDLL.dll
Resource
win7-20240419-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/ZipDLL.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/etxtmwc.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/etxtmwc.dll
Resource
win10v2004-20240426-en
General
-
Target
6871273a8b73eaad109b5f7754c2bf87_JaffaCakes118.exe
-
Size
751KB
-
MD5
6871273a8b73eaad109b5f7754c2bf87
-
SHA1
47a620d098902000d036e72c1d72d8405943a8f2
-
SHA256
0686c6037915bacc6460ab3e21076eb5c6ae80b9964afc17aa4ef8fcbcd4bde7
-
SHA512
dc8f23d60796ea8b184bf18f15965cff04584f8b67a39c093d0e8257ffe7734bd5e71cd99761fddb762db9eaa006e6ad055f6f998c95484ba3b4f06fe59211ee
-
SSDEEP
12288:jPf8MvKvQ+iw9AuwjB/ugHbouCJvZTyAZX8nqFL7qvSS2MOgLmC97P+WyO2cfc8u:j38UKKw6djB/FUuCJvXbFavSS2+Lm6+/
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
bedgifdheb.exepid process 932 bedgifdheb.exe -
Loads dropped DLL 2 IoCs
Processes:
6871273a8b73eaad109b5f7754c2bf87_JaffaCakes118.exepid process 3456 6871273a8b73eaad109b5f7754c2bf87_JaffaCakes118.exe 3456 6871273a8b73eaad109b5f7754c2bf87_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2892 932 WerFault.exe bedgifdheb.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
wmic.exewmic.exedescription pid process Token: SeIncreaseQuotaPrivilege 2364 wmic.exe Token: SeSecurityPrivilege 2364 wmic.exe Token: SeTakeOwnershipPrivilege 2364 wmic.exe Token: SeLoadDriverPrivilege 2364 wmic.exe Token: SeSystemProfilePrivilege 2364 wmic.exe Token: SeSystemtimePrivilege 2364 wmic.exe Token: SeProfSingleProcessPrivilege 2364 wmic.exe Token: SeIncBasePriorityPrivilege 2364 wmic.exe Token: SeCreatePagefilePrivilege 2364 wmic.exe Token: SeBackupPrivilege 2364 wmic.exe Token: SeRestorePrivilege 2364 wmic.exe Token: SeShutdownPrivilege 2364 wmic.exe Token: SeDebugPrivilege 2364 wmic.exe Token: SeSystemEnvironmentPrivilege 2364 wmic.exe Token: SeRemoteShutdownPrivilege 2364 wmic.exe Token: SeUndockPrivilege 2364 wmic.exe Token: SeManageVolumePrivilege 2364 wmic.exe Token: 33 2364 wmic.exe Token: 34 2364 wmic.exe Token: 35 2364 wmic.exe Token: 36 2364 wmic.exe Token: SeIncreaseQuotaPrivilege 2364 wmic.exe Token: SeSecurityPrivilege 2364 wmic.exe Token: SeTakeOwnershipPrivilege 2364 wmic.exe Token: SeLoadDriverPrivilege 2364 wmic.exe Token: SeSystemProfilePrivilege 2364 wmic.exe Token: SeSystemtimePrivilege 2364 wmic.exe Token: SeProfSingleProcessPrivilege 2364 wmic.exe Token: SeIncBasePriorityPrivilege 2364 wmic.exe Token: SeCreatePagefilePrivilege 2364 wmic.exe Token: SeBackupPrivilege 2364 wmic.exe Token: SeRestorePrivilege 2364 wmic.exe Token: SeShutdownPrivilege 2364 wmic.exe Token: SeDebugPrivilege 2364 wmic.exe Token: SeSystemEnvironmentPrivilege 2364 wmic.exe Token: SeRemoteShutdownPrivilege 2364 wmic.exe Token: SeUndockPrivilege 2364 wmic.exe Token: SeManageVolumePrivilege 2364 wmic.exe Token: 33 2364 wmic.exe Token: 34 2364 wmic.exe Token: 35 2364 wmic.exe Token: 36 2364 wmic.exe Token: SeIncreaseQuotaPrivilege 2808 wmic.exe Token: SeSecurityPrivilege 2808 wmic.exe Token: SeTakeOwnershipPrivilege 2808 wmic.exe Token: SeLoadDriverPrivilege 2808 wmic.exe Token: SeSystemProfilePrivilege 2808 wmic.exe Token: SeSystemtimePrivilege 2808 wmic.exe Token: SeProfSingleProcessPrivilege 2808 wmic.exe Token: SeIncBasePriorityPrivilege 2808 wmic.exe Token: SeCreatePagefilePrivilege 2808 wmic.exe Token: SeBackupPrivilege 2808 wmic.exe Token: SeRestorePrivilege 2808 wmic.exe Token: SeShutdownPrivilege 2808 wmic.exe Token: SeDebugPrivilege 2808 wmic.exe Token: SeSystemEnvironmentPrivilege 2808 wmic.exe Token: SeRemoteShutdownPrivilege 2808 wmic.exe Token: SeUndockPrivilege 2808 wmic.exe Token: SeManageVolumePrivilege 2808 wmic.exe Token: 33 2808 wmic.exe Token: 34 2808 wmic.exe Token: 35 2808 wmic.exe Token: 36 2808 wmic.exe Token: SeIncreaseQuotaPrivilege 2808 wmic.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
6871273a8b73eaad109b5f7754c2bf87_JaffaCakes118.exebedgifdheb.exedescription pid process target process PID 3456 wrote to memory of 932 3456 6871273a8b73eaad109b5f7754c2bf87_JaffaCakes118.exe bedgifdheb.exe PID 3456 wrote to memory of 932 3456 6871273a8b73eaad109b5f7754c2bf87_JaffaCakes118.exe bedgifdheb.exe PID 3456 wrote to memory of 932 3456 6871273a8b73eaad109b5f7754c2bf87_JaffaCakes118.exe bedgifdheb.exe PID 932 wrote to memory of 2364 932 bedgifdheb.exe wmic.exe PID 932 wrote to memory of 2364 932 bedgifdheb.exe wmic.exe PID 932 wrote to memory of 2364 932 bedgifdheb.exe wmic.exe PID 932 wrote to memory of 2808 932 bedgifdheb.exe wmic.exe PID 932 wrote to memory of 2808 932 bedgifdheb.exe wmic.exe PID 932 wrote to memory of 2808 932 bedgifdheb.exe wmic.exe PID 932 wrote to memory of 3868 932 bedgifdheb.exe wmic.exe PID 932 wrote to memory of 3868 932 bedgifdheb.exe wmic.exe PID 932 wrote to memory of 3868 932 bedgifdheb.exe wmic.exe PID 932 wrote to memory of 1528 932 bedgifdheb.exe wmic.exe PID 932 wrote to memory of 1528 932 bedgifdheb.exe wmic.exe PID 932 wrote to memory of 1528 932 bedgifdheb.exe wmic.exe PID 932 wrote to memory of 388 932 bedgifdheb.exe wmic.exe PID 932 wrote to memory of 388 932 bedgifdheb.exe wmic.exe PID 932 wrote to memory of 388 932 bedgifdheb.exe wmic.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6871273a8b73eaad109b5f7754c2bf87_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6871273a8b73eaad109b5f7754c2bf87_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bedgifdheb.exeC:\Users\Admin\AppData\Local\Temp\bedgifdheb.exe 1\5\7\4\9\9\8\5\3\8\6 LktCQDQoKy0zLRouTk4+R0A8OC0YKU1ATVNGSUNEQTUrHyo9RUpLQT86KTI4MikcJjpBPzooGi5LS0s7TDtPXEE+PCwxLSkwGCpQPUxVQEtbTElEOGVsbm81KCtqaW4pQT1NSihNS0ckOUtNJkNNQUgcJjpEREBDQ0M4GSs7KDUtLxgpQy02KSgXJz8wNScwGyhAKzQlLB0nPjQ4Ji0XJkhNTDxPQk9YTElATjxAUTcfKklORjtNPlFXP1RHOjkXJkhNTDxPQk9YSjhEPThlYW5sXGchKSdobWwdLC8uJzIcKShmYnFhZGkZKzxPPVpSSkY8GyhBTzxXPko8RkhJPjkXJkBKUExZQU1IU0o8SjguGClTQzpKQlBHUFxNTEs4GStNRDUtHSc+Uiw2HCZJTUlRQUdEWlBBQzpHSEJBR0BCPlFJQzUbLEFNXk1OSktARUA6bGx0YBkrSTxMUE9GQ01CWFFKPEpaQTlTUjgrHCY/QT9CUDcwGyhFSlY8VEs5R0g+WEFFOkpUTUw/QzhfXWNqXRssPElWSUVLODtXRE01KzgyJy0qLSYsMCwoMCsZK0c4SjxJRD9LWkJKSks5R0k1bnFwXhwmS0FIQjUrMy4vNC8oKDMwGClDSlBKQ0Y5P1xMQ0xANjMmKCwqLygrNCUqNiovMiswIkpM2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81716408112.txt bios get serialnumber3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81716408112.txt bios get version3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81716408112.txt bios get version3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81716408112.txt bios get version3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81716408112.txt bios get version3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 932 -s 8643⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 932 -ip 9321⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\81716408112.txtFilesize
66B
MD59025468f85256136f923096b01375964
SHA17fcd174999661594fa5f88890ffb195e9858cc52
SHA256d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df
SHA51292cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51
-
C:\Users\Admin\AppData\Local\Temp\81716408112.txtMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Users\Admin\AppData\Local\Temp\81716408112.txtFilesize
58B
MD5f8e2f71e123c5a848f2a83d2a7aef11e
SHA15e7a9a2937fa4f06fdf3e33d7def7de431c159b4
SHA25679dae8edfddb5a748fb1ed83c87081b245aeff9178c95dcf5fbaaed6baf82121
SHA5128d34a80d335ee5be5d899b19b385aeaeb6bc5480fd72d3d9e96269da2f544ccc13b30fd23111980de736a612b8beb24ff062f6bed2eb2d252dbe07a2ffeb701e
-
C:\Users\Admin\AppData\Local\Temp\bedgifdheb.exeFilesize
1.2MB
MD58774e61c3804a39841203c215ee939fa
SHA1586f647babc4987734678fb382e17827d897f952
SHA25631adab2582951b5fd658c42b39905c85b5edb60b9d91f979c1e0816b04b1f955
SHA5123b496a2ab43aa01b5f555fd8b45932108a1c89686e0322c3d942e873f1134c29c94ddaddc713d333602b722ddc6cf7ac2c209ee454325f6fc4bdf46aacfceb28
-
C:\Users\Admin\AppData\Local\Temp\nsd34EC.tmp\ZipDLL.dllFilesize
163KB
MD52dc35ddcabcb2b24919b9afae4ec3091
SHA19eeed33c3abc656353a7ebd1c66af38cccadd939
SHA2566bbeb39747f1526752980d4dbec2fe2c7347f3cc983a79c92561b92fe472e7a1
SHA5120ccac336924f684da1f73db2dd230a0c932c5b4115ae1fa0e708b9db5e39d2a07dc54dac8d95881a42069cbb2c2886e880cdad715deda83c0de38757a0f6a901
-
C:\Users\Admin\AppData\Local\Temp\nsd34EC.tmp\etxtmwc.dllFilesize
158KB
MD54d3c8a633d0bba7bc5b9010a69303d4d
SHA146aab421789437fc7cb681655739aff5d7578d8d
SHA256034f6c733cc6d45d953b9c0df9c2110defa569873bd2f6f0be61332264174344
SHA5127e92b5aa8d25809936d61ba22f89215088a3e97ca29cbfd033d0594669a7bd245519e777f7505a8fa83a09db3b31646ea050e22fe16f98a3c7e4c0c8f5d93acf