Analysis

  • max time kernel
    91s
  • max time network
    138s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-05-2024 17:35

General

  • Target

    7643525f6fc334d6031d2d273aa8f3d0_JaffaCakes118.exe

  • Size

    339KB

  • MD5

    7643525f6fc334d6031d2d273aa8f3d0

  • SHA1

    9672ef1c985c41afdc3da0238fc263def54aa41c

  • SHA256

    838afccf9de1c65b9f362a37477f5ad5f1f1c7ffb6d6292481c209997307dcc0

  • SHA512

    7021a22e4291e550c8ffe9b7088d590092cae58f61ddb2f7515819d02dca1d1baa2a5f483a6d14f53f84bb0dc6f2e77e9b4535d581b7ebeaf0be6de3ab77fbf3

  • SSDEEP

    6144:tFJ0ljL5Du5cQ77sHIWgTbF8cCzL0pdCS+ZqSPVxvU:wjZu5cQv3TbF8cCP0p88sjc

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7643525f6fc334d6031d2d273aa8f3d0_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\7643525f6fc334d6031d2d273aa8f3d0_JaffaCakes118.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1500
    • C:\Users\Admin\AppData\Local\Temp\beeigfajea.exe
      C:\Users\Admin\AppData\Local\Temp\beeigfajea.exe 9)1)8)3)0)0)9)3)6)1)5 Jk9BQT0xMDUuMRsmUk0/UEk7OiofKkVETFRPUkJGPjwsFy48RlNUQEE3MTEoNSkdL0NAQTcvGyZPSkxEVTpRWUg/NDEtMDQ3FyxNRE1NREpcVVJDOmJzb2c5Jyxzcm0rPkROQixMTFAtOE1KLURFRUcdL0NDRj1KRDs8GCxEMTQqKx8qOzE1KjEgJkEtPCgoHydBND0kLhouPyw8JS4gL0dPSUNQOlNXTVJJTT49WDgXLkhPT0RMQE5eQExLOTogL0dPSUNQOlNXS0FNPDpyeGdgbhgsRVg8XE9RRzRhXXB0NGdgKGJqZC5rYnR1Zytfd2AXLj1VRV86Sj5LREVENR0vSEZQTl49SU5PUEVSNDIaLk8/QEZIWU9MXE9RRzQfJ1NNPSkdKUNOKDwYLFJVRVFDTEBWVj1JQ09EQkNMPD5ETU9MPRcsQ1JaSVRGUUlNPDpucXBcHydPRVRMT0hIST5eTVBFUlZBO1hONDEYLEhJO0JSPCwXLkFQX0RQSztMRDpePUtDUlBNTkQ/NGVZaXNlFyw+TlJFS0c+RF9ATTcxKy8tKS4wLjAwKDAtKR8nTUFSOElGREdWSEZQVEFDSTdzbWxkGCxUSURCNzAvKzcuMjg4KjQaLj9GVkZJT0E7XE5ISDw8KS4vMi4sLC8sLCkxNzEzMTIxKUtE
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1020
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81716744926.txt bios get serialnumber
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4804
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81716744926.txt bios get version
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3752
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81716744926.txt bios get version
        3⤵
          PID:5052
        • C:\Windows\SysWOW64\Wbem\wmic.exe
          wmic /output:C:\Users\Admin\AppData\Local\Temp\81716744926.txt bios get version
          3⤵
            PID:3344
          • C:\Windows\SysWOW64\Wbem\wmic.exe
            wmic /output:C:\Users\Admin\AppData\Local\Temp\81716744926.txt bios get version
            3⤵
              PID:3896
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1020 -s 660
              3⤵
              • Program crash
              PID:4340
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1020 -ip 1020
          1⤵
            PID:3596

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\81716744926.txt

            Filesize

            66B

            MD5

            9025468f85256136f923096b01375964

            SHA1

            7fcd174999661594fa5f88890ffb195e9858cc52

            SHA256

            d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df

            SHA512

            92cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51

          • C:\Users\Admin\AppData\Local\Temp\81716744926.txt

            Filesize

            2B

            MD5

            f3b25701fe362ec84616a93a45ce9998

            SHA1

            d62636d8caec13f04e28442a0a6fa1afeb024bbb

            SHA256

            b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

            SHA512

            98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

          • C:\Users\Admin\AppData\Local\Temp\81716744926.txt

            Filesize

            58B

            MD5

            f8e2f71e123c5a848f2a83d2a7aef11e

            SHA1

            5e7a9a2937fa4f06fdf3e33d7def7de431c159b4

            SHA256

            79dae8edfddb5a748fb1ed83c87081b245aeff9178c95dcf5fbaaed6baf82121

            SHA512

            8d34a80d335ee5be5d899b19b385aeaeb6bc5480fd72d3d9e96269da2f544ccc13b30fd23111980de736a612b8beb24ff062f6bed2eb2d252dbe07a2ffeb701e

          • C:\Users\Admin\AppData\Local\Temp\beeigfajea.exe

            Filesize

            538KB

            MD5

            cdf092407cf6212f09032be896d638f7

            SHA1

            70d05432275c69bd583371692eb880205cf79a39

            SHA256

            a5c95b4510108aa0610fc3559fd1fba6cadf33463030a1867f31853327dd6d22

            SHA512

            febd2450ac69e83f8dea9d909844b4c72d1149109db8deac06148bdf1fa7fa40b949035c2f92083874627984a94958187f9ec8d69b514f06e99c8a60ad61bcae