Analysis

  • max time kernel
    120s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    01/06/2024, 18:25

General

  • Target

    8b5aee520a6fb8e53a731b1e5509a981_JaffaCakes118.exe

  • Size

    752KB

  • MD5

    8b5aee520a6fb8e53a731b1e5509a981

  • SHA1

    ab652c85a3fb1215852ce58e85da7a4695343c0c

  • SHA256

    14554462996a0201b043295fd0097af6b2c1e0d94aff6bc93a349a34ce181e2f

  • SHA512

    516620892c1b7f6f6f87b000690e209fbba0bbfb5066cbbf20291fd2987312712311740bf9ad5011701e382f6b91e0643c7b43c2de791c56b5bcba6749a7d0be

  • SSDEEP

    12288:gH/R6NnqMrT/e6SsKZQAD6JSWcGSRczUX5ZEhSxeIF+7tgT1CjJISCDCnlAW9IPo:gH/InbrGsKZQtJYGWczKZEhSxeOTQySH

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 11 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8b5aee520a6fb8e53a731b1e5509a981_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\8b5aee520a6fb8e53a731b1e5509a981_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1412
    • C:\Users\Admin\AppData\Local\Temp\bedgifdhca.exe
      C:\Users\Admin\AppData\Local\Temp\bedgifdhca.exe 7|8|5|2|1|0|1|2|6|3|6 KEhEQjwxODEwMBooS1BAT0lDOyodKUc9T1VOUkpHPjorHiorbnFvY3NdcWhaZWA7UWVoa1tkXxknP0dSVEhCNy8xMCktHi5DSEI3LRooSE1NQ1VCUllGPjYqMTczMx8tTUJMTz1NXVRSSzticW5pMiotcnJ1LD5CTUQlT01PLUBOSitDRz5KHi5DS0c9SEM9NRstQzE8KysdKT0qOCswIC5CLTonKhgqQjM9LC8aLD4uNSgvHy9PUElBTzxMWk5RSVU/PVY3GSdLUE5EVEFOXD9ORDw7Hy9PUElBTzxMWkxATUQ7Giw/UT1aU1FMPB4pQlI+Vz5LQ0xITD86GihASlFTX0FQSVRNPko4Mx8vU0Y7S0VSR1BdVFJLOxosUEY1LR4uRFIvNx0pS01JUkhNRF1RQkY8R0hDSE1ART9STEU1Gy1IU15QT0tOQkVAO3NydGMaLEw+TFBQTUlNRVlSTT5KWkJAWVI7LB0pQUE/Q1c9MB4pRk1YPFRMQE1IQVlCSDxKVE5TRUM7YF5mbF0bLUNPVkxGTDs9V0ROPDItLy0yKCsrKywwMjceKU07SzlHSkRMXkdIUE46REc7ZWFrcV8dKU1BSEM8MTMxMDUwMiovLh8vQ01RS0ZIOT9dU0lMQzc0KSosKjAvMTQoKy00Kyg1Mi8qQEs=
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2888
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81717266342.txt bios get serialnumber
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1832
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81717266342.txt bios get version
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2096
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81717266342.txt bios get version
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2636
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic /output:C:\Users\Admin\AppData\Local\Temp\81717266342.txt bios get version
        3⤵
          PID:2028
        • C:\Windows\SysWOW64\Wbem\wmic.exe
          wmic /output:C:\Users\Admin\AppData\Local\Temp\81717266342.txt bios get version
          3⤵
            PID:2640
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 372
            3⤵
            • Loads dropped DLL
            • Program crash
            PID:2552

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\81717266342.txt

        Filesize

        66B

        MD5

        9025468f85256136f923096b01375964

        SHA1

        7fcd174999661594fa5f88890ffb195e9858cc52

        SHA256

        d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df

        SHA512

        92cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51

      • \Users\Admin\AppData\Local\Temp\bedgifdhca.exe

        Filesize

        1.2MB

        MD5

        5a81957b711997843031232113059963

        SHA1

        c08a9fc2a4592f8e8f25dee1f271b869e1a83e47

        SHA256

        ec474e59c8e22d98df155005782c1f3cdfbd08ba52b7593804f3f101cad6e454

        SHA512

        6ed304da44a6e64fae26a2a41b633d4dfd2d47ab9f0ac0d2b5db293fe02c9167598610103a58469eb2016bb80a14a90b2b2084145b8a8c2f2802971a0d5a1421

      • \Users\Admin\AppData\Local\Temp\nsyABF9.tmp\ZipDLL.dll

        Filesize

        163KB

        MD5

        2dc35ddcabcb2b24919b9afae4ec3091

        SHA1

        9eeed33c3abc656353a7ebd1c66af38cccadd939

        SHA256

        6bbeb39747f1526752980d4dbec2fe2c7347f3cc983a79c92561b92fe472e7a1

        SHA512

        0ccac336924f684da1f73db2dd230a0c932c5b4115ae1fa0e708b9db5e39d2a07dc54dac8d95881a42069cbb2c2886e880cdad715deda83c0de38757a0f6a901

      • \Users\Admin\AppData\Local\Temp\nsyABF9.tmp\etxtmwc.dll

        Filesize

        158KB

        MD5

        4d3c8a633d0bba7bc5b9010a69303d4d

        SHA1

        46aab421789437fc7cb681655739aff5d7578d8d

        SHA256

        034f6c733cc6d45d953b9c0df9c2110defa569873bd2f6f0be61332264174344

        SHA512

        7e92b5aa8d25809936d61ba22f89215088a3e97ca29cbfd033d0594669a7bd245519e777f7505a8fa83a09db3b31646ea050e22fe16f98a3c7e4c0c8f5d93acf